Start here! Get your feet wet with the Microsoft cloud and begin your journey to earning your Microsoft Certified: Azure Fundamentals certification!
Gauge your current knowledge
Gauge your current knowledge
Management groups are the top-level containers in Azure that let you organize and manage multiple subscriptions and resources. They form a governance layer above subscriptions and resource groups, helping you apply consistent policies and access controls across large Azure deployments. Using management groups ensures that your organization can enforce rules and standards without having to configure them on every individual subscription.
Azure organizes its resources in a three-tier hierarchy: management groups at the top to group subscriptions, subscriptions that contain resource groups and resources, and resource groups that hold related resources for a solution. This structure provides a clear path for inheritance and management from the top down. You can nest management groups under other management groups to build complex hierarchies that match your organizational structure.
When you apply a policy or role at a management group, all subscriptions and resource groups under it inherit those settings automatically. This inheritance model reduces administrative overhead and provides a unified way to manage compliance and security across environments. For example, a global security policy enforced at a management group applies to every subscription beneath it without manual configuration.
A subscription is a core billing unit in Azure that groups related services and resources under one administrative boundary. Each subscription provides a single billing relationship and contains a unique subscription ID used in the Azure portal or command-line tools. By organizing workloads into subscriptions, you can track costs and manage billing separately for each project or department. Subscriptions are tied to one Microsoft Entra ID tenant, ensuring consistent authentication and identity management across all resources.
The hierarchy has four levels: management group at the top, subscription which holds resource groups, resource group that organizes resources, and resource which is the smallest deployable item. This parent-child structure helps you apply settings and policies at the right level and simplifies management. You can view and manage this hierarchy in the Azure portal under the Management Groups and Subscriptions blades.
Access to subscriptions is controlled through Azure Role-Based Access Control. When you assign a role at the subscription scope, all resource groups and resources under that subscription inherit those permissions. For example, granting the Contributor role at the subscription level allows users to manage all resources inside, while Reader limits them to view-only access. Subscriptions also serve as the primary scope for policies and compliance, allowing you to enforce tagging, naming conventions, and security standards across all resource groups automatically.
In Azure, all requests go through Azure Resource Manager, a consistent deployment and management layer. Azure organizes its resources in a hierarchy of scopes with four levels: management groups, subscriptions, resource groups, and resources. This structure ensures that policies and permissions flow down from higher levels to lower ones.
At the top of the hierarchy are management groups, which provide a way to group subscriptions for governance and compliance. A single management group can contain both subscriptions and other management groups, forming a nested structure. Policies and role assignments set at a management group automatically apply to all child subscriptions and resource groups. This allows organizations to manage access and policies in one place, making large-scale governance simpler.
Below management groups are subscriptions, which serve as billing and access boundaries. Each subscription is associated with a Microsoft Entra directory and has its own billing account. Subscriptions can inherit policies, permissions, and tags from their parent management group, but they also allow specific configurations for teams or projects. Within a subscription, you organize resources into resource groups to manage them as logical units.
Inside a subscription, resource groups hold related resources that share the same lifecycle. You can manage, deploy, or delete all resources in a resource group together, which simplifies operations for an application or environment. Resource groups inherit policies and permissions from both their subscription and management group, ensuring consistent controls. You decide which resources belong to a resource group based on what makes sense for management and billing.
At the bottom of the hierarchy are individual resources, such as virtual machines, databases, and storage accounts. These resources are the actual services running in Azure and inherit all policies, role assignments, and tags from their parent resource groups, subscriptions, and management groups. You can manage any level of this hierarchy using the Azure portal, Azure PowerShell, Azure CLI, or REST APIs, all of which interact through Azure Resource Manager.
A resource group is a container in Azure that holds related resources for a solution. You decide which resources go together based on your organization's needs, but generally you group resources that share the same lifecycle so they can be deployed, updated, and deleted as one unit. This approach helps maintain organization and consistency across your cloud environment.
The purpose of resource groups is to provide a logical boundary for resource management. They help with tasks such as deployment, monitoring, and policy enforcement at scale. Key benefits include simplified deployment where you can provision or remove all resources in a group with a single operation, consistent management where you can apply tags, locks, and policies uniformly across resources, and cost tracking where you can view billing and usage for related resources in one place.
Resource groups fit into Azure's hierarchical structure as one level of scope. At the top are management groups, which organize multiple subscriptions. Under each subscription are resource groups, and within them are individual resources. This hierarchy means you can apply policies and role assignments at different levels and have them inherited by child objects.
The resource group also stores metadata about its resources. When you specify a location for the resource group, you choose where that metadata lives for compliance and resiliency reasons. Control-plane operations for resource groups are routed through the chosen region, so it is best to pick a location close to your operations. Resource groups serve as a scope for Azure Role-Based Access Control, allowing you to assign roles like Owner, Contributor, or Reader that apply only to the resources in that group.
Azure resources are organized in a hierarchy of management groups, subscriptions, resource groups, and resources. This layered structure provides clear scopes for policies and access control, allowing you to enforce consistent settings and security across your entire environment.
Management groups sit at the top and let you organize multiple subscriptions into containers that mirror your organization's structure. Azure Policy and Role-Based Access Control assignments applied at this level are inherited by all child subscriptions. You can nest management groups to delegate governance and compliance responsibilities at different levels of your organization.
Subscriptions serve as billing and access boundaries that contain resource groups. You can attach Azure Policy at the subscription scope to control costs, enforce location requirements, or apply tagging standards across every resource group. Similarly, assigning RBAC roles at this level helps manage who can create or modify resources within the subscription.
Resource groups act as containers for resources that share the same lifecycle or purpose. They store metadata in a specified region, ensuring data residency compliance when needed. Applying policies and RBAC roles at the resource group scope lets you grant or restrict permissions for a specific set of resources without affecting others.
Using this hierarchy, you can implement governance and compliance by applying Azure Policy at the management group level to enforce naming conventions and location rules, assigning RBAC roles at the subscription or resource group scope to follow the principle of least privilege, and auditing and monitoring inheritance to ensure all resources adhere to organizational standards and security requirements.