TopolearnEvery permission, policy, budget and deployment in Azure is scoped to one level of this hierarchy.
Azure organizes resources in a strict hierarchy, and almost every other feature hangs off it.
- Tenant: one Microsoft Entra ID directory (users, groups, apps). Your organization usually has exactly one.
- Management groups: optional folders of subscriptions, nested up to six levels under a single root management group. Used to apply policy and access to many subscriptions at once.
- Subscription: the unit of billing and a hard boundary for quotas and many limits. A subscription trusts exactly one tenant.
- Resource group: a logical container for resources that share a lifecycle. Every resource lives in exactly one resource group; deleting the group deletes everything inside it.
- Resource: a VM, storage account, database and so on.
Access (RBAC), Azure Policy and budgets assigned at a level are inherited by everything below it. Assign "Reader" on a subscription and the person can read every resource group in it.
A resource group has a region, but that only says where its metadata is stored; resources inside can live in any region. Group by lifecycle and ownership, not by resource type: "orders-api-prod" (app, database, cache) is better than "all-databases".
Teams commonly split environments into separate subscriptions (prod, non-prod) so quotas, costs and access stay isolated.
Example
az account list --query "[].{name:name, id:id, tenant:tenantId}" -o table
az account set --subscription "Contoso Dev"
az group create --name rg-orders-dev --location westeurope
az group list --query "[].name" -o tsv
# rg-orders-dev
# Deleting the group deletes every resource inside it
az group delete --name rg-orders-dev --yes --no-waitRemember
- Tenant > management groups > subscriptions > resource groups > resources
- Access, policy and budgets inherit downward
- A subscription is the billing and quota boundary
- Group resources by shared lifecycle, not by type
Watch out for
- Putting unrelated workloads in one resource group, so you cannot delete or grant access to one without the other.