Management Groups · OUs · Folders — Azure · AWS · GCP
The organizational hierarchy divides your cloud footprint into logical units for billing, IAM inheritance, and policy enforcement. All three clouds use a tree structure where policies flow top-down.
Tree: Root MG → Department MGs → Subscriptions. Subscriptions contain Resource Groups. Azure Policy and RBAC inherit downward. Up to 6 levels of MGs.
CLI: az account management-group create --name Dev-MG
Tree: Organization Root → OUs → Accounts. SCPs inherit top-down. Up to 5 levels of OUs. Each account is a billing+security boundary.
CLI: aws organizations create-organizational-unit --parent-id r-xxxx --name Dev
Tree: Organization → Folders → Projects. Org Policies and IAM inherit downward. Each project is a namespace+billing boundary.
CLI: gcloud resource-manager folders create --organization=ORG_ID --display-name=dev
| Layer | Azure | AWS | GCP |
|---|---|---|---|
| Top Node | Root Management Group | Organization Root | Organization |
| Mid Tier | Management Group (up to 6) | Organizational Unit (up to 5) | Folder (up to 10 levels) |
| Leaf Node | Subscription | Account | Project |
| Resource Grouping | Resource Group | (tag-based, flat) | (label-based, flat) |
| Policy Inheritance | Top-down (Azure Policy) | Top-down (SCPs) | Top-down (Org Policies) |
| IAM Inheritance | Inherits downward | Does NOT cross accounts | Inherits downward |
| Billing Boundary | Subscription | Account | Project + Billing Account |
| Max Depth | 6 MG + Sub + RG | 5 OU + Account | 10 Folders + Project |
az account management-group listaz account list
aws organizations list-rootsaws organizations list-accounts
gcloud organizations listgcloud resource-manager folders list --organization=ORG_ID