Cascade Regional Airlines is reorganizing its management group hierarchy and moves the Kiosk-Ops subscription out of the Corporate management group and into the Outstations management group, which carries stricter Azure Policy assignments. What is the immediate effect on resources in the Kiosk-Ops subscription?

Both Azure Policy assignments and RBAC role assignments made at a management group scope are inherited downward through the hierarchy to every child subscription, resource group, and resource. When a subscription is moved to a different parent management group, that inheritance path changes immediately: the subscription picks up whatever is assigned at its new parent and any management groups above it, and it no longer receives assignments that only existed on the old parent's branch. The idea that old policies linger until manually removed misunderstands inheritance as a copy operation rather than a live, hierarchy-based evaluation that Azure Resource Manager recalculates continuously. There is no billing-cycle delay involved; governance inheritance is not tied to cost processing at all. RBAC assignments made directly at the old management group also do not get copied down onto individual resources; they simply stop applying once the subscription is no longer a descendant of that scope, so anyone relying solely on that inherited access loses it and needs a fresh assignment if they still require access. As a caveat, role and policy assignments made directly at the subscription or resource-group level are unaffected by the move, since those scopes travel with the subscription regardless of its parent. Confirm the new state by checking the Policy Compliance blade and the IAM blade on Kiosk-Ops immediately after the move.