Resources, Resource Groups, and Subscriptions

Azure’s organisational hierarchy

The hierarchy visualised

Management Groups
  └── Subscriptions
        └── Resource Groups
              └── Resources

Summit Construction’s hierarchy:

Root Management Group
  ├── IT Management Group
  │     ├── Production Subscription ($2,000/month)
  │     │     ├── RG: project-portal-prod
  │     │     │     ├── VM: portal-vm-01
  │     │     │     ├── SQL Database: portal-db
  │     │     │     └── Storage: portal-files
  │     │     └── RG: monitoring-prod
  │     │           └── Log Analytics Workspace
  │     └── Development Subscription ($400/month)
  │           └── RG: project-portal-dev
  │                 ├── VM: portal-vm-dev
  │                 └── SQL Database: portal-db-dev
  └── Finance Management Group
        └── Finance Subscription ($300/month)
              └── RG: accounting-app
                    ├── App Service: accounting-web
                    └── SQL Database: accounting-db

Resources — the building blocks

A resource is any Azure service you create:

• A virtual machine
• A storage account
• A SQL database
• A virtual network
• An App Service web app

Key rules:

• Every resource belongs to exactly one resource group
• Resources can be in different regions from their resource group
• Resources can communicate across resource groups and subscriptions

Resource groups — logical containers

A resource group is a container that holds related Azure resources. Think of it as a project folder.

Key rules about resource groups:

Rule	Detail
Every resource needs one	A resource cannot exist outside a resource group
One group only	A resource can only be in one resource group at a time
Groups can’t be nested	You can’t put a resource group inside another resource group
Deleting a group deletes everything	Delete the resource group → all resources inside are deleted
Permissions inherit	Apply permissions to the group → all resources inside inherit them
Resources can be in different regions	A resource group in “Australia East” can contain resources in “US East”

Peak Roasters’ resource groups

Peak Roasters organises their Azure resources by application:

Resource Group	Resources Inside	Purpose
rg-website	App Service, SQL Database, Storage	Online ordering website
rg-email	(managed by Microsoft 365)	Business email
rg-backups	Storage account, Recovery vault	Data backups

💡 Exam tip: Resource group location

A resource group has a location (region), but this is only where the group’s metadata is stored. The resources inside can be in any region.

Example: Resource group in “Australia East” can contain a VM in “US West” and a database in “UK South.”

Why does the group location matter? For compliance — some organisations need metadata stored in specific geographies.

Subscriptions — billing boundaries

A subscription provides:

• Billing boundary — each subscription gets its own invoice
• Access control boundary — you can set different permissions per subscription
• Resource limits — each subscription has quotas (e.g., max VMs per region)

Why multiple subscriptions?

Reason	Example
Separate billing	Production vs development have different budgets
Access control	Developers can access dev subscription but not production
Compliance	Regulated workloads in a separate subscription with stricter policies
Resource limits	Approaching quota limits in one subscription

Harbour Health uses three subscriptions:

• Production — patient-facing apps, strict access controls
• Development — dev/test environments, more relaxed permissions
• Sandbox — experimentation, auto-delete after 30 days

Management groups — governance at scale

When an organisation has many subscriptions, management groups help manage them:

• Apply Azure Policy to a management group → it applies to ALL subscriptions underneath
• Assign RBAC roles at the management group level → inherited by all subscriptions
• Nest management groups up to 6 levels deep (not counting the root)

Key facts:

• Every Microsoft Entra ID tenant has a single root management group
• All subscriptions belong to the root management group by default
• You can create sub-groups to organise subscriptions by department, environment, or region

ℹ️ Management group hierarchy limits

• 10,000 management groups per directory
• 6 levels of depth (excluding root)
• Each management group or subscription can have only one parent
• Each management group can have many children

This tree structure means policies and access controls flow DOWN from parent to child — a powerful governance mechanism for large organisations.

🎬 Video walkthrough

🎬 Video coming soon

Resources, Resource Groups, and Subscriptions — AZ-900

Resources, Resource Groups, and Subscriptions — AZ-900

~10 min

Flashcards

Question

What is an Azure resource?

Click or press Enter to reveal answer

Answer

Any Azure service you create — a VM, database, storage account, virtual network, etc. Every resource belongs to exactly one resource group.

Click to flip back

💡 Show hint

Question

What happens when you delete a resource group?

Click or press Enter to reveal answer

Answer

ALL resources inside the group are deleted. This is called lifecycle management — the group and its contents share a lifecycle.

Click to flip back

💡 Show hint

Question

What is the purpose of Azure subscriptions?

Click or press Enter to reveal answer

Answer

Subscriptions provide a billing boundary (separate invoices) and an access control boundary (different permissions). An account can have multiple subscriptions for different teams, environments, or budgets.

Click to flip back

Question

What are management groups used for?

Click or press Enter to reveal answer

Answer

To apply governance (Azure Policy, RBAC) across multiple subscriptions at once. They sit above subscriptions in the hierarchy and form a tree structure with a root management group at the top.

Click to flip back

💡 Show hint

Knowledge Check

Knowledge Check

Peak Roasters wants to ensure that when they're done with their test environment, all test resources are cleaned up with a single action. What should they use?

ADelete each resource individuallyBPlace all test resources in a single resource group and delete the groupCCancel the subscriptionDUse Azure Policy to auto-delete old resources

Check Answer

Knowledge Check

Harbour Health wants production and development environments to have separate billing. What is the BEST way to achieve this?

AUse different resource groups within one subscriptionBUse different Azure regions for each environmentCUse separate subscriptions for production and developmentDUse management groups to separate billing

Check Answer

Knowledge Check

What is the correct hierarchy from TOP to BOTTOM in Azure's organisational structure?

AResources → Resource Groups → Subscriptions → Management GroupsBManagement Groups → Subscriptions → Resource Groups → ResourcesCSubscriptions → Management Groups → Resource Groups → ResourcesDManagement Groups → Resource Groups → Subscriptions → Resources

Check Answer

---

Next up: Azure Virtual Machines — the most common IaaS service, including Scale Sets, availability sets, and Azure Virtual Desktop.