The hierarchy is the first thing you build in a landing zone, and it is the hardest thing to change later. Management Groups (MGs) provide a scope above the subscription level, allowing you to apply Azure Policies and RBAC roles that cascade down to every child resource. A well-designed tree enables …