AZ-900 Describe cloud concepts Practice Question
What is the relationship between an Azure tenant, a subscription, and a resource group?
⚠ Common exam trap
Test-takers frequently confuse the Azure hierarchy direction—candidates often invert the relationship between tenants and subscriptions, mistakenly thinking a subscription can contain multiple tenants, when in fact a tenant is the top-level container that can have many subscriptions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A tenant contains subscriptions, subscriptions contain resource groups, resource groups contain resources
The Azure hierarchy is strictly defined: an Azure tenant (representing an organization's identity in Azure AD) contains one or more subscriptions, each subscription contains one or more resource groups, and each resource group contains resources like VMs or databases. This layered structure enables management, billing, and access control at each level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A tenant contains subscriptions, subscriptions contain resource groups, resource groups contain resources
Why this is correct
This statement correctly describes the Azure management hierarchy. A Microsoft Entra ID tenant is the top-level identity boundary that owns one or more Azure subscriptions. Each subscription is a billing and access-control scope, and it can contain multiple resource groups. Resource groups are logical containers used to organize related resources, and those resources are deployed directly inside a resource group. This layered structure defines how RBAC, policies, and cost management are applied across the environment.
- ✗
A subscription contains tenants, tenants contain resource groups
Why it's wrong here
This statement inverts the actual Azure hierarchy. A tenant is the Microsoft Entra ID directory that contains one or more subscriptions, not the other way around. Resource groups are contained within subscriptions, not directly inside a tenant. The correct relationship is: tenant -> subscriptions -> resource groups -> resources. A tenant can span multiple subscriptions, but a subscription belongs to exactly one tenant (typically), and resource groups never reside at the tenant level.
- ✗
Resource groups and subscriptions are the same thing
Why it's wrong here
Subscriptions and resource groups are fundamentally different concepts at different levels of the hierarchy. A subscription is a billing and access boundary that is linked to a tenant and defines the terms of resource usage and payment. A resource group is a management container that exists inside a subscription and is used to group resources for lifecycle management and permissions. You can have many resource groups within a single subscription, and a resource group cannot exist independently of a subscription.
- ✗
A tenant is inside a subscription
Why it's wrong here
A tenant is not placed inside a subscription; it is the identity directory that establishes trust for authentication and authorization. Each subscription is associated with, and trusts, a single tenant for identity services, but the tenant is the broader container and the subscription is a subordinate scope. In practice, a tenant can own multiple subscriptions, but a subscription cannot contain a tenant or exist outside a tenant. This misconception often arises because subscriptions are linked to a tenant through an Azure AD directory, but the tenant remains the higher-level boundary.
Go deeper
Related to this question
Learn chapter
Service Level Agreements (SLAs) in Azure
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.