Quickstart: Create a management group with JavaScript

Management groups are containers that help you manage access, policy, and compliance across multiple subscriptions. Create these containers to build an effective and efficient hierarchy that can be used with Azure Policy and Azure Role Based Access Controls. For more information on management groups, see Organize your resources with Azure management groups.

The first management group created in the directory could take up to 15 minutes to complete. There are processes that run the first time to set up the management groups service within Azure for your directory. You receive a notification when the process is complete. For more information, see initial setup of management groups.

Prerequisites

• If you don't have an Azure subscription, create a trial subscription account before you begin.

• Before you start, make sure that at least version 12 of Node.js is installed.

• Any Microsoft Entra ID user in the tenant can create a management group without the management group write permission assigned to that user if hierarchy protection isn't enabled. This new management group becomes a child of the Root Management Group or the default management group and the creator is given an Owner role assignment. Management group service allows this ability so that role assignments aren't needed at the root level. When the Root Management Group is created, users don't have access to it. To start using management groups, the service allows the creation of the initial management groups at the root level. For more information, see Root management group for each directory.

Application setup

To enable JavaScript to manage management groups, the environment must be set up. This setup works wherever JavaScript can be used, including bash on Windows 10.

1. Set up a new Node.js project by running the following command.

   npm init -y
   

2. Add a reference to the yargs module.

   npm install yargs
   

3. Add a reference to the Azure Resource Graph module.

   npm install @azure/arm-managementgroups
   

4. Add a reference to the Azure authentication library.

   npm install @azure/identity
   

   Note

   Verify in package.json @azure/arm-managementgroups is version 2.0.1 or higher and @azure/identity is version 2.0.4 or higher.

Create the management group

1. Create a new file named index.js and enter the following code.

      const argv = require("yargs").argv;
      const { InteractiveBrowserCredential } = require("@azure/identity");
      const { ManagementGroupsAPI } = require("@azure/arm-managementgroups");
   
      if (argv.groupID && argv.displayName) {
         const createMG = async () => {
            const credentials = new InteractiveBrowserCredential();
            const client = new ManagementGroupsAPI(credentials);
            const result = await client.managementGroups.beginCreateOrUpdateAndWait(
               argv.groupID,
               {
                  displayName: argv.displayName
               }
            );
            console.log(result);
         };
   
      createMG();
   }
   

2. Enter the following command in the terminal:

   node index.js --groupID "<NEW_MG_GROUP_ID>" --displayName "<NEW_MG_FRIENDLY_NAME>"
   

   Make sure to replace each token <> placeholder with your management group ID and management group friendly name, respectively.

   As the script attempts to authenticate, a message similar to the following message is displayed in the terminal:

   Note

   To sign in, use a web browser to open the page https://microsoft.com/deviceloginchina and enter the code FGB56WJUGK to authenticate.

   Once you authenticate in the browser, then the script continues to run.

The result of creating the management group is output to the console.

Clean up resources

If you wish to remove the installed libraries from your application, run the following command.

npm uninstall @azure/arm-managementgroups @azure/identity yargs

Next steps

In this quickstart, you created a management group to organize your resource hierarchy. The management group can hold subscriptions or other management groups.

To learn more about management groups and how to manage your resource hierarchy, continue to: