Azure Subscription Access, Organization and Billing

Configure and Assess Subscription Access and Role Assignments

Azure role-based access control (Azure RBAC) is the primary system for managing access to Azure resources. RBAC allows you to assign roles to security principals—users, groups, service principals, or managed identities—at scopes such as management group, subscription, resource group, or resource. The main built-in roles are Owner (full management and role assignment), Contributor (manage resources but not RBAC), and Reader (view resources). Specialized roles exist for granular control, and you can create custom roles when built-ins do not meet your requirements.

Role assignments implement the principle of least privilege, ensuring users have only the permissions they need. Assigning a role at a parent scope, such as a management group, means all child resources (subscriptions, resource groups, and resources) inherit that access. For example, assigning Owner at the subscription level enables management of all resources within that subscription. Privileged administrator roles like Owner and User Access Administrator should be limited and carefully audited to reduce security risks.

Management groups provide a hierarchy to organize and govern multiple subscriptions. By creating a hierarchy, you can apply policies and RBAC assignments at higher levels, which are then inherited by all descendant subscriptions and resources. The root management group sits at the top of each Microsoft Entra directory and is used for global policy and access assignments. It is best practice to restrict the root management group to essential, low-impact policies and always test changes before applying them enterprise-wide.

To assign roles at the subscription level, you need appropriate permissions—typically being assigned Owner, User Access Administrator, or Role Based Access Control Administrator at that scope. Assignments can be made using the Azure portal, PowerShell, CLI, or REST API. You can list and audit role assignments using the Access control (IAM) blade, which helps track who has what permissions. Limits exist, such as 4000 role assignments per subscription and 500 per management group.

Auditing and assessing access is essential for security and compliance. Use Azure Monitor activity logs and Privileged Identity Management (PIM) to track changes to role assignments, monitor privileged access, and enforce just-in-time activation. Regularly review who has privileged roles, ensure multiple subscription owners for redundancy (but not too many), and remove deprecated accounts. Azure Policy can enforce access control standards, such as limiting the number of subscription owners or auditing custom RBAC roles.

Automating role assignments and governance at the subscription level is possible using ARM templates or Bicep files. This enables consistent deployment of access controls, policies, and resource groups. When moving subscriptions between management groups, ensure that role definitions and assignments maintain a valid hierarchy path to avoid breaking inherited permissions. Plan and document your access model, and use Azure’s built-in tools to regularly assess, monitor, and optimize subscription access and role assignments for effective governance.

Implement Subscription Lifecycle Operations and Resource Organization

Azure allows programmatic creation of subscriptions using REST APIs, ARM templates, or Bicep to automate deployment across Enterprise (EA), Microsoft Customer (MCA), and Partner (MPA) agreements. When managing the subscription lifecycle, administrators must handle subscription transfers carefully: moving a subscription to a different tenant requires the new owner to accept ownership via an email request within seven days. To properly decommission a subscription, delete all resources first to stop charges before formal cancellation.

Management groups provide a governance scope above subscriptions, enabling enterprise-grade management at scale through a hierarchical structure. A single directory supports up to 10,000 management groups with a maximum depth of six levels, excluding the root and subscription levels. Key benefits include policy inheritance (governance conditions apply to all nested subscriptions), access control (RBAC assignments cascade to child resources), and efficient organization (subscriptions can be moved between groups to align with changing business needs).

Effective resource organization relies on resource groups and resource tags to provide business context for cost tracking and management. Resource groups are the lowest level of organization, while tags offer the most flexibility for mapping resources to specific departments, projects, or owners. Using these tools allows organizations to implement cost allocation and chargeback processes, ensuring internal business units are accountable for their specific cloud consumption.

Transferring a subscription to a different Microsoft Entra directory is a complex operation that permanently deletes all RBAC role assignments and custom roles. Administrators must manually re-create these security principals and update both system-assigned and user-assigned managed identities in the target directory. Because this process often involves downtime and significant reconfiguration, careful planning and auditing of all service dependencies is required before execution.

Microsoft Cost Management provides advanced tools like budget alerts and anomaly detection to proactively monitor spending across various scopes. Organizations can use cost analysis to forecast future expenses and identify optimization opportunities, such as Azure savings plans or reservations. To maintain high operational efficiency, administrators should regularly review cost allocation strategies and use Power BI for complex reporting on multi-subscription environments.

Implement Subscription Policies and Billing Management

Billing Management in Azure involves tools and processes to manage costs, subscriptions, and invoices efficiently. The Billing section in the Azure portal provides comprehensive tools to manage billing accounts, pay invoices, and analyze costs. Cost Management is integrated within the billing experience, providing visibility into costs at various levels such as subscriptions, resource groups, and management groups. This integration ensures users can optimize their workloads for maximum efficiency.

Key features include invoice management (view and pay invoices, configure billing addresses, manage purchase orders), cost analysis (using Power BI for advanced reporting and analytics), and exports and APIs to integrate cost details into external systems. Organizing and allocating costs is crucial for internal billing and chargeback processes. Azure provides several options: billing profiles and invoice sections group subscriptions into invoices for different business units; departments and enrollment accounts serve similar roles in cost details; management groups group subscriptions with inherited access and compliance rules; and resource tags add business context for applications, business units, and environments.

Azure offers various alerts to manage costs proactively: budget alerts notify when costs exceed predefined amounts, anomaly alerts detect unexpected charges, and scheduled alerts provide regular updates on cost status. Subscription policies enforce governance and optimize resource allocation. Policies can be configured to manage access to cost data and ensure compliance with organizational requirements. Enable access to costs by configuring settings for different scopes, and manage Azure reservations to optimize cost savings. Effective billing management and subscription policies ensure efficient use of resources and compliance with organizational requirements, leveraging tools like Cost Management, billing profiles, and alerts to optimize cloud spending and maintain control over the Azure environment.