This chapter covers Azure Subscriptions and how Management Groups organize them. AZ-900 tests this under objective 2.1, as part of understanding Azure's overall management hierarchy.
Jump to a section
A simple way to picture Azure Subscriptions and Management Groups
Think of an Azure subscription like a household's shared account with a single utility provider — it's the billing boundary that ties usage together and determines who gets the bill. Within that household, individual family members might have their own responsibilities and access to different parts of the house, but the utility bill itself is tracked at the household level. An Azure subscription works similarly: it's the billing and access-management boundary that groups resources together, tracks their cost, and applies access control, while the resources within it can still be organized and managed individually.
What a subscription is
An Azure subscription is a logical container that groups together resources and their associated billing. Every Azure resource belongs to exactly one subscription, and costs are tracked and billed at the subscription level.
The management hierarchy
Azure's organizational hierarchy, from broadest to narrowest, generally looks like: Management Groups (optional, for organizing multiple subscriptions) → Subscriptions (billing and access boundary) → Resource Groups (logical container for related resources) → Resources (the individual services themselves). Access control and policy can be applied at any level of this hierarchy, and settings generally flow down to the levels beneath them.
Why organizations use multiple subscriptions
Larger organizations often use multiple subscriptions to separate billing (for example, by department or project), apply different access controls, or isolate environments (like development versus production) from each other.
Management groups
For organizations with several subscriptions, management groups provide an additional organizational layer above subscriptions, letting policies and access control be applied consistently across multiple subscriptions at once, rather than configuring each subscription separately.
Understand the hierarchy from the top down
Management groups (optional) sit above subscriptions, which sit above resource groups, which contain the individual resources — settings can be applied at any level and generally flow down.
Create or select a subscription
Every resource must belong to a subscription — an organization might use a single subscription for everything, or multiple subscriptions to separate billing or access by department, project, or environment.
Organize resources into resource groups within the subscription
Within a subscription, resources are further organized into resource groups for management purposes, as covered in the Azure Resource Manager chapter.
Apply management groups for multi-subscription organizations
Organizations with several subscriptions can use management groups to apply consistent policy and access control across all of them at once.
A company separates its development and production environments into different subscriptions, so access controls and policies can differ between them — developers might have broad access in the development subscription but restricted access in production.
A larger enterprise with several business units uses management groups to apply a consistent security policy across all of its subscriptions at once, rather than manually configuring the same policy in each subscription individually — reducing the chance of a subscription being accidentally missed.
Objective 2.1 expects candidates to understand the subscription's role as the billing and access boundary, and how it fits into the broader management hierarchy alongside management groups and resource groups.
A common wrong answer is confusing a subscription with a resource group — a subscription is the billing and top-level access boundary; a resource group is a logical container for related resources *within* a subscription. Another common trap is assuming management groups are required — they're optional and mainly useful for organizations managing multiple subscriptions.
Stable terms: Subscription, Management Group, Resource Group. Knowing the order of this hierarchy (management groups → subscriptions → resource groups → resources) is a frequently tested detail.
Memory trick: subscriptions handle billing and top-level access. Resource groups organize resources for management within a subscription. Management groups organize multiple subscriptions together, when needed.
An Azure subscription is the logical container that groups resources together for billing and top-level access control.
Every Azure resource belongs to exactly one subscription.
The management hierarchy runs from management groups (optional) down through subscriptions, resource groups, to individual resources.
Organizations often use multiple subscriptions to separate billing, access, or environments like development and production.
These come up on the exam all the time. Here's how to tell them apart.
Subscription
Billing and top-level access boundary
Contains one or more resource groups
Broader organizational scope
Resource Group
Logical container for related resources
Exists within a single subscription
Narrower, project- or workload-specific scope
Mistake
A subscription and a resource group are the same thing.
Correct
A subscription is the billing and top-level access boundary; a resource group is a logical container for related resources within a subscription. They serve different organizational purposes.
Mistake
Every organization needs management groups.
Correct
Management groups are optional and primarily useful for organizations managing multiple subscriptions together — a single-subscription organization may never need one.
Mistake
Resources can belong to more than one subscription.
Correct
Every Azure resource belongs to exactly one subscription at a time.
It's the logical container that groups Azure resources together for billing purposes and top-level access control. Every resource belongs to exactly one subscription, and usage costs are tracked at the subscription level.
A subscription is the billing and top-level access boundary, containing one or more resource groups. A resource group is a logical container for related resources within a subscription, used for more granular organization and management.
Not necessarily — management groups are optional and mainly useful for organizations managing multiple subscriptions, letting them apply consistent policy and access control across all of them at once. A single-subscription setup doesn't require one.
You've just covered Azure Subscriptions and Management Groups — now see how well it sticks with free AZ-900 practice questions. Full explanations included, no account needed.
Done with this chapter?