Chapter 08 — Azure Resources, Resource Groups, Subscriptions & Management Groups

Overview

Azure organizes everything into a clear hierarchy. Understanding this hierarchy helps you manage costs, access control, and policies at scale.

The hierarchy from bottom to top:

Resources
  └── Resource Groups
        └── Subscriptions
              └── Management Groups
                    └── Azure Active Directory (Entra ID) Tenant

Each level can contain policies, access controls, and billing settings that flow down to the levels below.

1. Resources

A resource is any individual service or component you create in Azure.

Examples of Azure resources:

• A Virtual Machine

• A Storage Account

• A SQL Database

• A Virtual Network

• An App Service

• A Key Vault

Key Facts

2. Resource Groups

A resource group is a logical container that holds related Azure resources for a project, application, or workload.

Think of it like a folder on your computer — it groups related files (resources) together.

Resource Group: "MyWebApp-RG"
├── Virtual Machine (Web Server)
├── SQL Database
├── Virtual Network
├── Storage Account
└── App Service Plan

Key Facts

Best Practices for Naming Resource Groups

Recommended naming convention:

{project}-{environment}-{region}-rg

Examples:
  ecommerce-prod-eastus-rg
  payroll-dev-westeurope-rg
  analytics-test-centralindia-rg

Grouping Strategies

3. Subscriptions

An Azure subscription is a billing and access boundary — it's how you pay for Azure services.

Subscription: "Contoso Production"
├── Resource Group: "WebApp-RG"
│     ├── VM
│     └── Database
├── Resource Group: "Networking-RG"
│     └── Virtual Network
└── Resource Group: "Security-RG"
      └── Key Vault

Key Facts

Why Have Multiple Subscriptions?

Subscription Types

4. Management Groups

Management groups sit above subscriptions and allow you to organize and govern multiple subscriptions at once.

Root Management Group (Tenant-level)
├── Management Group: "Corp IT"
│     ├── Subscription: Production
│     ├── Subscription: Development
│     └── Subscription: Testing
├── Management Group: "Subsidiaries"
│     ├── Subsidiary A Subscription
│     └── Subsidiary B Subscription
└── Management Group: "Sandbox"
      └── Sandbox Subscription

Key Facts

Why Use Management Groups?

• Apply a security policy across all 50 subscriptions at once (instead of 50 times)

• Grant a security team read access across all subscriptions from one place

• Enforce compliance rules organization-wide consistently

The Full Hierarchy

Azure AD / Entra ID Tenant
  └── Root Management Group
        ├── Management Group A
        │     ├── Subscription 1
        │     │     ├── Resource Group 1
        │     │     │     ├── Resource (VM)
        │     │     │     └── Resource (DB)
        │     │     └── Resource Group 2
        │     │           └── Resource (Storage)
        │     └── Subscription 2
        └── Management Group B
              └── Subscription 3

What You Can Apply at Each Level

Policies and permissions applied at a higher level automatically inherit down to all child levels.

Resource Tagging

Tags are name-value pairs you attach to resources for organization, filtering, and cost tracking.

Example tags on a VM:

Environment: Production
Department:  Finance
Owner:       jane.doe@company.com
CostCenter:  CC-2045
Project:     Payroll

Benefits of Tags

• Filter resources by department, project, or environment

• Track costs per team or project in billing reports

• Automate operations based on tags (e.g., shut down all "Dev" VMs at night)

• Enforce tagging with Azure Policy

Quick Recap

Resources       → Individual Azure services (VM, DB, etc.)
Resource Groups → Logical containers for related resources
Subscriptions   → Billing + access boundaries
Management Groups → Governance across multiple subscriptions

Hierarchy: Resource → Resource Group → Subscription → Management Group → Tenant
Policies and permissions flow DOWN the hierarchy.

Official References

• Azure resource organization — Microsoft Learn

• Resource groups — Microsoft Learn

• Management groups — Microsoft Learn

• Azure subscriptions — Microsoft Learn

Next Chapter → Chapter 09: Azure Compute Services