Azure organises everything into a hierarchy that people routinely get wrong on their first project. The cost of getting it wrong is a migration, so it is worth ten minutes up front.
The four layers
| Layer | What it is for |
|---|---|
| Tenant (Entra ID directory) | Your identity boundary. Users, groups and app registrations live here. |
| Management group | Groups subscriptions so policy and access apply to many at once. |
| Subscription | The billing and quota boundary. This is the important one. |
| Resource group | A lifecycle container for resources deployed and deleted together. |
Why the subscription matters most
Quotas apply per subscription per region. Hitting a vCPU limit does not mean your account is exhausted, it means that subscription’s allocation in that region is. Increases are requested through the portal and reviewed.
Billing is also per subscription, which makes the subscription the natural boundary between environments. Production in its own subscription gives you clean cost reporting and prevents a load test in development from consuming production’s quota headroom.
Resource groups are about lifecycle
A resource group should contain things that are created, updated and destroyed together. The usual mistake is organising them by resource type, with all databases in one group and all virtual machines in another. That makes teardown dangerous and deployment awkward.
Group by application and environment instead. Deleting a resource group deletes everything in it, which is a feature when the grouping matches a real lifecycle and a disaster when it does not.
Management groups and policy
Azure Policy applied at a management group inherits down to every subscription beneath it. This is how you enforce, for example, that resources may only be created in approved regions, or that public IP addresses are denied outside a specific subscription.
Even a small organisation benefits from one management group holding production and another holding everything else.
A workable starting structure
- One tenant.
- Two management groups: Production and Non-production.
- One subscription per environment, at minimum production separated from the rest.
- Resource groups per application per environment.
- Consistent tags for owner, environment and cost centre from day one.
The reasoning behind environment separation applies to every platform, not just Azure. See separate cloud accounts.
Where accounts come in
Our Azure listings cover four configurations, including trial and pay-as-you-go options carrying a $200 credit and larger credit tiers. The difference that matters is what happens when the credit runs out, which is covered in Azure account tiers explained.
Common questions
Can I move a resource between resource groups?
Many resource types support moving, some do not, and the operation locks resources during the move. Structure correctly first.
Do quotas follow the tenant or the subscription?
The subscription, per region.
Do I need management groups for a small project?
Not strictly, but adding them later means restructuring policy assignments. Two groups cost nothing.