Management Groups, Subscriptions, and Resource Groups.
By Pooja | 7th July 2025
Introduction
Microsoft Azure is a comprehensive cloud computing platform that provides a wide array of services for building, deploying, and managing applications through Microsoft-managed data centers. One of the key challenges organizations face in large-scale Azure environments is the effective management of resources, policies, and access controls. To address this challenge, Azure provides a structured hierarchy comprising Management Groups, Subscriptions, and Resource Groups.
These three components are fundamental to organizing, managing, and securing resources in Azure at scale. Whether you’re managing a small environment or a large enterprise with multiple departments and teams, understanding and implementing these organizational units effectively can ensure better governance, compliance, cost control, and operational efficiency.
Azure Management Group
1.1 What is an Azure Management Group?
Azure Management Groups provide a level of scope above subscriptions. They are used to manage access, policies, and compliance across multiple Azure subscriptions. If your organization has many subscriptions, you can organize them into containers called “management groups” and apply your governance conditions to the management groups.
All subscriptions within a management group automatically inherit the conditions applied to the management group. Management groups allow you to efficiently manage access, policy, and compliance across multiple subscriptions.
1.2 Key Features of Management Groups
- Hierarchy and Organization: You can build a tree of management groups to reflect your organization’s structure. Each management group can have a single parent and multiple children.
- Policy Inheritance: Azure Policy and Role-Based Access Control (RBAC) assignments flow down from the management group to the subscriptions below it.
- Scalability: Designed for large enterprises, management groups can support thousands of subscriptions.
- Root Management Group: By default, Azure creates a single root management group at the top of the hierarchy to which all management groups and subscriptions belong.
1.3 Use Cases
- Centralized governance across a large number of subscriptions.
- Applying security policies or cost management strategies at a global or regional level.
Grouping subscriptions by business units, departments, or environments (Dev, Test, Prod).
Azure Subscription
2.1 What is an Azure Subscription?
An Azure Subscription is a logical container used to provision resources in Azure. It holds the details of all the resources like virtual machines, databases, storage, and services you use. Subscriptions help define boundaries for resource management and billing.
Each subscription has its own billing account and is linked to a specific Azure Active Directory (Azure AD) tenant for identity management.
2.2 Types of Azure Subscriptions
Azure offers various types of subscriptions, including:
- Free Trial: Offers a limited amount of free resources for 30 days.
- Pay-As-You-Go: Charges are based on usage, suitable for startups or growing businesses.
- Enterprise Agreement (EA): Best for large organizations needing high-volume use.
- Microsoft Customer Agreement (MCA): A flexible agreement for commercial customers.
2.3 Key Aspects of Subscriptions
- Billing: Each subscription has its own billing and payment method.
- Quota and Limits: Resources have quota limits which are tracked per subscription.
- Isolation: Subscriptions can be used to isolate environments or projects.
- Access Control: Role assignments are managed at the subscription level using RBAC.
2.4 Use Cases
- Separating development and production environments.
- Isolating departments or business units.
- Managing different cost centers for budgeting and reporting.
Azure Resource Group
3.1 What is an Azure Resource Group?
A Resource Group is a container that holds related resources for an Azure solution. It includes everything that an application or service needs such as virtual machines, storage accounts, virtual networks, databases, etc.
The resource group makes it easier to manage and organize resources as a single entity. You can deploy, update, and delete resources together as a group.
3.2 Characteristics of Resource Groups
- Logical Grouping: Used to group resources logically for better manageability.
- Resource Lifecycle Management: You can manage the lifecycle of all resources in a group together.
- Location: The metadata for the resource group is stored in a specific region, but resources in a group can be in different locations.
- Access Control: You can apply RBAC at the resource group level for fine-grained access management.
3.3 Best Practices
- Group resources by application lifecycle: one resource group per application.
- Name resource groups meaningfully for easy identification.
- Use tags to organize resources within and across resource groups.
- Avoid placing resources with different lifecycles in the same resource group.
3.4 Use Cases
- Managing resources of a single application or project.
- Grouping all resources needed for a deployment, making automation easier. Simplifying monitoring, billing, and policy application
Hierarchical Relationship and Governance
4.1 Azure Hierarchy Overview
The full hierarchy of organizational structure in Azure is as follows:
pgsql
CopyEdit
Management Group
Subscription
Resource Group
Resources (VMs, Databases, etc.)
This structure allows for scalable, secure, and compliant resource management.
4.2 Policy and Access Management
- Azure Policy: Enables you to enforce rules across your hierarchy (e.g., enforce the use of specific VM sizes).
- Role-Based Access Control (RBAC): Assigns roles to users, groups, or applications with scoped permissions at the management group, subscription, or resource group level.
4.3 Security and Compliance
Using this hierarchy helps ensure:
- Centralized policy enforcement.
- Better access control management.
Simplified audit and compliance reporting.
Real-Life Scenario
Imagine a multinational company “Contoso Ltd.” with operations in three regions: North America, Europe, and Asia. They can design their Azure resource organization as follows:
- Management Group: Contoso
- Sub-MG: North America
- Subscriptions: NA-Prod, NA-Test
- Sub-MG: Europe
- Subscriptions: EU-Prod, EU-Dev
- Sub-MG: Asia
- Subscriptions: Asia-Sales, Asia-Dev
- Sub-MG: North America
Within each subscription, they can create resource groups such as:
- RG-WebApps
- RG-Database
- RG-Network
This structure allows them to:
- Apply regional policies.
- Track billing by subscription.
- Manage application resources via resource groups.
Conclusion
Understanding the structure and purpose of Management Groups, Subscriptions, and Resource Groups in Azure is essential for efficient cloud resource management, especially in large and complex environments.
Management Groups offer a scalable way to govern access and policies across multiple subscriptions. Subscriptions serve as containers for billing, isolation, and resource provisioning. Resource Groups, in turn, allow you to manage and organize related Azure resources efficiently.
By properly utilizing this hierarchy, organizations can ensure:
- Simplified governance and policy enforcement
- Enhanced security and access management
- Clearer cost tracking and reporting
- Better operational efficiency and automation
As organizations grow and adopt Azure for more workloads, using this structure becomes not just a best practice but a necessity. Thoughtful planning of your management group hierarchy, subscription strategy, and resource group organization can lead to a more secure, compliant, and efficient Azure environment.