Management groups sit above subscriptions and bundle them under a single governance umbrella. Applying a policy or access control at the management group level ensures consistent enforcement across all its subscriptions. You can move subscriptions between management groups using the Azure portal, Azure PowerShell, or the Azure CLI. When moving, you need permission at the child subscription or management group, the target parent, and the current parent, ensuring proper access control is maintained.
This hierarchical model provides centralized management, policy inheritance, and scalable governance. By organizing subscriptions under management groups, you can enforce security standards, control costs, and simplify access management at every level.
Subscription Management and Governance
You can manage Azure subscriptions using familiar tools: the Azure portal for a graphical interface, the Azure CLI for command-line automation, and Azure PowerShell for integration into existing scripts. These tools provide consistent ways to create, list, and filter subscriptions.
Governance is essential for secure and compliant management. Role-Based Access Control (RBAC) lets you assign roles such as Owner, Contributor, or Reader at the subscription level, controlling who can make changes. You can also configure subscription policies that govern whether subscriptions can be transferred into or out of a directory. Exempted users can bypass these policies for special scenarios. Effective cost management relies on clear subscription organization; many organizations use subscriptions to separate business units or environments, making it easier to allocate budgets and track spending. Azure Cost Management, budget alerts, and tags help enforce naming conventions and ensure consistent cost reporting.
Subscription Lifecycle and Limits
Creating an Azure subscription typically involves choosing an offer type (such as Pay-As-You-Go, Free Trial, or Enterprise Agreement) and specifying a directory. You can create subscriptions manually in the Azure portal, programmatically using the Subscription – Create REST API, or through Enterprise Agreement enrollment or Cloud Solution Provider (CSP) partners. When you create a subscription in another tenant, a subscription creation request is sent, and the target owner must accept it within seven days.
After creation, you view and manage subscriptions on the Subscriptions page in the portal, where you can filter by status, billing scope, or directory. Subscription policies control migrations between directories, with settings like Permit no one or Allow Everyone, and a list of exempted users can bypass these policies. To cancel or delete a subscription, you first delete all resources within it, leaving an empty container. Cancellation is effective immediately, but any outstanding charges for support or prepaid commitment may still apply.
Each subscription has limits and quotas that govern resource usage. For example, the Azure Automation service has default quotas per subscription per region, such as a maximum of 10 automation accounts and up to 50 concurrent jobs. To increase quotas, submit a Support request or check region availability. Understanding these service limits helps you plan capacity and ensures reliable operations.
Billing and Cost Management
Azure subscriptions are the primary billing containers. Each subscription is linked to a billing account, which tracks invoices, payments, and usage details. Within a billing account, you can view and download invoices, manage payment methods, and assign Owner, Contributor, or Reader roles to control who can view or pay bills. Properly configuring your billing account ensures charges flow to the correct subscription.
Azure Cost Management + Billing provides tools for monitoring and optimizing spending. Features include cost analysis to slice and filter costs by service, resource group, or tag; budgets and alerts for spending limits and notifications; and exports to automate cost data to storage. Access control uses RBAC at different scopes: management groups, subscriptions, and resource groups. Roles cascade down from higher scopes, ensuring consistent permissions.
Cost optimization is key to efficient cloud spending. Azure offers Azure Advisor for tailored cost-saving suggestions, Azure Reservations and Savings Plans for discounted rates when you prepay or commit to resources, and Azure Hybrid Benefit to use existing on-premises licenses to lower costs. Adopting these strategies can lead to significant savings while keeping workloads running smoothly.
