krnese
commented
3 years ago Thanks for submitting the issue.
If you deploy ESLZ into a new tenant, or a tenant that hasn't enabled Management Group yet, the deployment will effectively enable it and the default "Tenant Root Group" is being created first, and ESLZ will create its intermediate root group below followed by the rest of the ESLZ hierarchy. What's happening in parallel, is that each subscription that exist in the tenant - that is not moved by the ESLZ deployment will appear under the new "Tenant Root Group".
Also, default in each tenant is to place all new subscriptions under the "Tenant Root Group", unless a different management group is being specified during creation. There's a setting for this on the "Tenant Root Group" that organizations can configure, and we have recommended the following in the design area for "Management Groups and Subscription organization" in CAF:
Since a tenant may have already specified the default management group for new subscriptions, and may have a subscription provisioning process in place before deploying ESLZ, we are currently not configuring this during the deployment as it could disrupt existing processes.
Would it be sufficient if we provided this as an option, and let you select between "Corp", "Online", and "Sandbox" for default placement for new subscriptions, unless specified during the subscription create process?
jtracey93
lloydlimmsft
Springstone
When CAF ESLZ is deployed, all newly created subscriptions automatically appear under the root management group.
Recommend the creation of another management group (Call it "Unassigned" or "New Subscriptions"). Then change the default to make all newly created subscriptions appear in this management group.
Also add a policy in this management group "Allowed Resource Types" - just allow one type like "policy Assignments". This ensures that a newly created subscription cannot create any resources in Azure until it has been placed in the correct management group in the hierarchy