Quickstart: Create a management group with .NET Core

Article
08/17/2021

Management groups are containers that help you manage access, policy, and compliance across multiple subscriptions. Create these containers to build an effective and efficient hierarchy that can be used with Azure Policy and Azure Role Based Access Controls. For more information on management groups, see Organize your resources with Azure management groups.

The first management group created in the directory could take up to 15 minutes to complete. There are processes that run the first time to set up the management groups service within Azure for your directory. You receive a notification when the process is complete. For more information, see initial setup of management groups.

Prerequisites

If you don't have an Azure subscription, create a free account before you begin.
An Azure service principal, including the clientId and clientSecret. If you don't have a service principal for use with Azure Policy or want to create a new one, see Azure management libraries for .NET authentication. Skip the step to install the .NET Core packages as we'll do that in the next steps.
Any Azure AD user in the tenant can create a management group without the management group write permission assigned to that user if hierarchy protection isn't enabled. This new management group becomes a child of the Root Management Group or the default management group and the creator is given an "Owner" role assignment. Management group service allows this ability so that role assignments aren't needed at the root level. No users have access to the Root Management Group when it's created. To avoid the hurdle of finding the Azure AD Global Admins to start using management groups, we allow the creation of the initial management groups at the root level.

Azure Cloud Shell

Azure hosts Azure Cloud Shell, an interactive shell environment that you can use through your browser. You can use either Bash or PowerShell with Cloud Shell to work with Azure services. You can use the Cloud Shell preinstalled commands to run the code in this article, without having to install anything on your local environment.

To start Azure Cloud Shell:

Option	Example/Link
Select Try It in the upper-right corner of a code or command block. Selecting Try It doesn't automatically copy the code or command to Cloud Shell.
Go to https://shell.azure.com, or select the Launch Cloud Shell button to open Cloud Shell in your browser.
Select the Cloud Shell button on the menu bar at the upper right in the Azure portal.

To use Azure Cloud Shell:

Start Cloud Shell.
Select the Copy button on a code block (or command block) to copy the code or command.
Paste the code or command into the Cloud Shell session by selecting Ctrl+Shift+V on Windows and Linux, or by selecting Cmd+Shift+V on macOS.
Select Enter to run the code or command.

Application setup

To enable .NET Core to manage management groups, create a new console application and install the required packages.

Check that the latest .NET Core is installed (at least 3.1.8). If it isn't yet installed, download it at dotnet.microsoft.com.
Initialize a new .NET Core console application named "mgCreate":
```
dotnet new console --name "mgCreate"
```

Change directories into the new project folder and install the required packages for Azure Policy:

# Add the Azure Policy package for .NET Core
dotnet add package Microsoft.Azure.Management.ManagementGroups --version 1.1.1-preview

# Add the Azure app auth package for .NET Core
dotnet add package Microsoft.Azure.Services.AppAuthentication --version 1.6.1

Replace the default program.cs with the following code and save the updated file:

using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Microsoft.IdentityModel.Clients.ActiveDirectory;
using Microsoft.Rest;
using Microsoft.Azure.Management.ManagementGroups;
using Microsoft.Azure.Management.ManagementGroups.Models;

namespace mgCreate
{
    class Program
    {
        static async Task Main(string[] args)
        {
            string strTenant = args[0];
            string strClientId = args[1];
            string strClientSecret = args[2];
            string strGroupId = args[3];
            string strDisplayName = args[4];

            var authContext = new AuthenticationContext($"https://login.microsoftonline.com/{strTenant}");
            var authResult = await authContext.AcquireTokenAsync(
                   "https://management.core.windows.net",
                   new ClientCredential(strClientId, strClientSecret));

            using (var client = new ManagementGroupsAPIClient(new TokenCredentials(authResult.AccessToken)))
            {
                var mgRequest = new CreateManagementGroupRequest
                {
                    DisplayName = strDisplayName
                };
                var response = await client.ManagementGroups.CreateOrUpdateAsync(strGroupId, mgRequest);
            }
        }
    }
}

Build and publish the mgCreate console application:
```
dotnet build
dotnet publish -o {run-folder}
```

Create the management group

In this quickstart, you create a new management group in the root management group.

Change directories to the {run-folder} you defined with the previous dotnet publish command.

Enter the following command in the terminal:

mgCreate.exe `
   "{tenantId}" `
   "{clientId}" `
   "{clientSecret}" `
   "{groupID}" `
   "{displayName}"

The preceding commands use the following information:

{tenantId} - Replace with your tenant ID
{clientId} - Replace with the client ID of your service principal
{clientSecret} - Replace with the client secret of your service principal
{groupID} - Replace with the ID for your new management group
{displayName} - Replace with the friendly name for your new management group

The result is a new management group in the root management group.

Clean up resources

Delete the new management group through the portal.
If you wish to remove the .NET Core console application and installed packages, delete the mgCreate project folder.

Next steps

In this quickstart, you created a management group to organize your resource hierarchy. The management group can hold subscriptions or other management groups.

To learn more about management groups and how to manage your resource hierarchy, continue to:

Manage your resources with management groups