From 8ac359e8e835dc9037ca4ca3db8d63d5dc1d119b Mon Sep 17 00:00:00 2001
From: Paul <86801738+CRYP70N1X@users.noreply.github.com>
Date: Thu, 28 Nov 2024 12:12:22 +0200
Subject: [PATCH] Updated message on root mgmgt group policy exclusion (#1850)

Co-authored-by: Jack Tracey <41163455+jtracey93@users.noreply.github.com>
---
 docs/wiki/ALZ-Policies.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docs/wiki/ALZ-Policies.md b/docs/wiki/ALZ-Policies.md
index 6dab86f385..04aeaede2c 100644
--- a/docs/wiki/ALZ-Policies.md
+++ b/docs/wiki/ALZ-Policies.md
@@ -44,6 +44,9 @@ AzAdvertizer also updates once per day!
 
 As part of a default deployment configuration, policy and policy set definitions are deployed at multiple levels within the Azure landing zone Management Group hierarchy as depicted within the below diagram.
 
+> [!IMPORTANT]
+> As part of the ALZ portal deployment/configuration, policy and policy set definitions are created only at the intermediate management group, e.g. `contoso` that is a child of the tenant root management group, created during the ALZ deployment. Our automation does not assign any policies to the tenant root management group scope, only the ALZ hierarchy it deploys and its children, e.g. `contoso` and below. This approach aligns with the Cloud Adoption Framework's best practices for Azure Policy assignment, ensuring clear delineation of policy application and avoiding unintended policy inheritance across the entire tenant. By placing policies only at the intermediary root and its child management groups, we maintain compliance, flexibility, and alignment with organizational governance requirements. And also allow multiple management groups hierarchies to exist in a single tenant such as the [canary approach](https://aka.ms/alz/canary#example-scenarios-and-outcomes)
+
 ![image](./media/MgmtGroups_Policies_v0.1.svg)
 
 The subsequent sections will provide a summary of policy sets and policy set definitions applied at each level of the Management Group hierarchy.