Azure Subscriptions, Management Groups and Resource Groups: Complete Guide

Azure Learning Path — Stage 1, Chapter 3. Azure environments become difficult to secure and govern when resources are created without a clear hierarchy. This chapter explains the scopes that organize Azure: Microsoft Entra tenant, management groups, subscriptions, resource groups and resources.

What you will learn#

• How Azure hierarchy works.
• What a subscription really represents.
• Why management groups exist.
• How to design resource groups.
• How governance and RBAC inheritance work across scopes.
• Practical CLI examples and an enterprise design lab.

1. Azure hierarchy#

The hierarchy matters because access control and governance can be assigned at different scopes and inherited downward.

2. Microsoft Entra tenant#

The tenant is the identity directory associated with users, groups, service principals, applications and administrative roles. An Azure subscription trusts one Microsoft Entra tenant for authentication.

3. What is an Azure subscription?#

A subscription is an important management, billing and scale boundary. Azure resources are deployed under a subscription, and costs are recorded there. Organizations commonly use multiple subscriptions to separate environments, teams, business units, regulatory boundaries or platform services.

When should you consider multiple subscriptions?#

• Production and non-production require stronger isolation.
• Different departments need separate billing or cost ownership.
• Workloads have different governance requirements.
• Platform teams operate shared connectivity or identity services.
• Resource quotas and scale need independent boundaries.

4. Management groups#

Management groups sit above subscriptions. They are designed to organize subscriptions at scale and provide a scope where governance such as Azure Policy and access assignments can be applied to many subscriptions consistently.

For example:

A policy assigned at a management-group scope can be inherited by subscriptions below it. This is powerful, so management-group structure should be stable and designed around governance needs rather than mirroring every temporary org-chart change.

5. Resource groups#

A resource group is a logical container for Azure resources. It is commonly used to group resources that share a lifecycle, owner, environment or application boundary.

Good example#

Another valid example#

A networking team might create separate resource groups for shared hub networking because the lifecycle and ownership differ from application resources.

6. What a resource group is not#

• It is not a network boundary.
• It is not an identity directory.
• It is not automatically a billing account.
• It does not automatically apply its tags to child resources.
• It is not required that all resources in a group be in the same Azure region.

7. Scope and inheritance#

Azure RBAC and policy can be assigned at different scopes:

A role assignment at subscription scope can apply to resource groups and resources below that subscription. A narrower resource-group assignment limits the access scope.

8. Example enterprise subscription model#

This design makes governance, cost reporting and blast-radius management easier than putting every workload into one subscription.

9. Azure CLI examples#

List subscriptions:

Select a subscription:

Confirm current subscription:

Create a resource group:

List resource groups:

10. Naming strategy#

A consistent naming convention makes search, operations and cost analysis easier.

Do not create names that depend only on the current employee or project nickname. Prefer names that remain meaningful over the resource lifecycle.

11. Common design mistakes#

• Putting every production and development workload in one subscription.
• Creating one resource group per individual resource without a lifecycle reason.
• Mirroring a fast-changing org chart in the management-group hierarchy.
• Assigning Owner at management-group scope casually.
• Using resource groups as if they were network security boundaries.
• Deleting a resource group without understanding that its contained resources are deleted with it.

12. Hands-on lab#

1. Open Management groups in the Azure portal and inspect the hierarchy available to your account.
2. Open Subscriptions and record the active subscription ID.
3. Create rg-azure-stage1-dev.
4. Add Environment=Dev, Owner=Student and CostCenter=Learning tags.
5. Use Azure CLI to list the resource group.
6. Open Access control (IAM) on the resource group and observe inherited permissions.
7. Delete the test resource group after the lab if it contains no required resources.

13. Interview questions#

1. What is the difference between a tenant and a subscription?
2. Why would an enterprise use management groups?
3. What is a resource group?
4. Can a resource group contain resources from different regions?
5. Why separate production and non-production subscriptions?
6. How does RBAC inheritance work across Azure scopes?

Official References#

• Microsoft Learn documentation for the related Azure service and governance topic.