Resources, resource groups and subscriptions

Azure organises what you create into four levels. Each level can carry settings, access rules and policies, which flow down to the levels beneath it.

Resources

A resource is a single thing you create: a virtual machine, a storage account, a database, a virtual network.

Resource groups

A resource group is a container for resources that belong together, usually because they share a lifecycle, such as everything for one application or one environment.

Rules the exam tests:

• Every resource is in exactly one resource group.
• Resource groups cannot be nested inside each other.
• A resource can be moved to another resource group.
• Resources in a group can be in different regions.
• Deleting a resource group deletes every resource in it. This makes it easy to clean up a whole test environment at once.
• Access permissions applied to a group apply to everything inside it.

Subscriptions

A subscription is a unit of billing and management. Every resource group belongs to one subscription. To use Azure you need an Azure account, which can hold one or more subscriptions; each subscription trusts one Microsoft Entra tenant for sign-in.

A subscription is two kinds of boundary:

• Billing boundary: each subscription gets its own bills and invoices, so you can separate costs.
• Access control boundary: access policies are applied at subscription level, so different teams can have different access.

Organisations use several subscriptions to separate:

• Billing: for example a separate bill for each department.
• Environments: development, test and production.
• Organisational structure: a different subscription for each team, with its own access.
• Limits: each subscription has its own service limits (quotas), so a very large workload may need more than one.

Management groups

A management group contains subscriptions (and other management groups), so you can apply access control and policy to many subscriptions at once.

• Management groups can be nested up to six levels deep, not counting the root management group at the top or the subscription level.
• Each management group and each subscription has exactly one parent.
• A single directory can hold up to 10,000 management groups.

A typical use: a "Production" management group whose policy allows only certain VM sizes, so every production subscription under it follows the rule, including ones added later.

The hierarchy

Settings applied at a higher level are inherited by everything below it. Apply a policy to a management group and every subscription, resource group and resource beneath it must follow it.