Master Azure's organizational hierarchy from management groups to individual resources. Learn how subscriptions, resource groups, and management structures work together to provide billing boundaries, access control, and enterprise-scale governance for your cloud infrastructure.
Crafted with care by Venu Vallepu
Imagine you're managing IT for a multinational company with thousands of applications, millions of users, and strict compliance requirements. How do you organize thousands of virtual machines, databases, and storage accounts across multiple teams, departments, and geographic regions while maintaining security, controlling costs, and ensuring governance? Azure's hierarchical management structure provides the answer through a carefully designed organizational model.
Tenant-level (Enterprise)
Each subscription has its own billing boundary - IT can track costs separately from Marketing
Developers get access to Dev subscription, but not Production - automatic security boundaries
Apply company-wide policies at management group level, specific rules at subscription level
Delete entire resource group when project ends - all resources go away together
Apply security policies across all 50 subscriptions with one management group policy
Marketing gets $10K/month budget on their subscription, IT gets $50K/month
All resources for "Customer Portal v2" project in one resource group for easy management
Track which resources belong to which cost center, environment, or project owner
GlobalTech Manufacturing: 15,000 employees across 25 countries, $2B annual revenue, strict compliance requirements (SOX, ISO), multiple business units, and complex IT governance needs.
GlobalTech-Root: Enterprise-wide security and compliance policies
Manufacturing-MG, Sales-MG, RnD-MG, Corporate-MG (budget allocation by unit)
Prod-Manufacturing, Dev-Manufacturing, Test-Sales, etc. (isolation by environment)
ERP-Prod-RG, CRM-Prod-RG, MES-Manufacturing-RG (by application lifecycle)
Think of an Azure subscription as your "account" with Microsoft - it's where your bill comes from, where usage is tracked, and where access is controlled. Every Azure resource must belong to exactly one subscription, making it the fundamental unit for billing, access management, and policy enforcement. Understanding subscriptions is crucial because they define the boundaries of your Azure environment.
All resources in a subscription appear on the same bill and invoice
Permissions can be granted at subscription level for all resources within
Policies, compliance, and governance settings apply subscription-wide
Each subscription has limits (quotas) on number and type of resources
contoso.onmicrosoft.com
Identity & Directory Service
$15K/month
$3K/month
$1K/month
Subscription trusts one Azure AD tenant for authentication and authorization
Users and groups from trusted tenant can be assigned roles in subscription
Subscriptions can be moved between tenants (with proper authorization)
Separate by Lifecycle
Separate by Business Unit
Separate by Location
15 VMs running 24/7 (D4s_v3 instances)
50TB blob storage + premium SSDs
VPN Gateway + Load Balancer + data transfer
SQL Database Standard tier
Billing Period: March 2025
Resource groups are like project folders in Azure - they logically group related resources that share the same lifecycle, permissions, and policies. Think of building a web application: you'd put the web app, database, storage account, and networking components all in the same resource group because they belong to the same project and will be managed together throughout their lifecycle.
Groups related Azure resources for management, billing, and permissions
Delete resource group = delete all resources inside it instantly
Apply RBAC (Role-Based Access Control) at resource group level
Resource group has a location, but resources can be in any region
All resources for one application together
Separate dev, test, and production resources
Group by technology or service layer
Resources managed by specific teams
Set up logical container for new project resources with appropriate naming and location.
Add related resources that share the same lifecycle and management requirements.
Apply policies, monitor costs, manage access, and maintain resources throughout their operational lifecycle.
Apply RBAC roles to team members for appropriate access levels
Track spending and set budgets at resource group level
Ensure resources follow organizational standards
When project ends, delete resource group to clean up all resources instantly and stop all charges.
Deleting a resource group is permanent and irreversible. All resources inside will be deleted immediately.
Resources that are created, managed, and deleted together should be in the same resource group
Use naming convention like: {ProjectName}-{Environment}-{Purpose}-RG
Tag for cost center, environment, owner, and project from the beginning
Grant minimum permissions needed for each team member or service
Don't put all resources in one group - makes management and permissions complex
Don't mix production and development resources in same group
Random names make it impossible to understand purpose and ownership
Remember that resource group location only affects metadata storage
Management groups provide a governance layer above subscriptions, enabling enterprise-scale management of access, policies, and compliance across multiple subscriptions. Think of them as organizational units that help large enterprises apply consistent policies and access controls across hundreds or thousands of subscriptions while maintaining flexibility at lower levels.
Apply policies at management group level and inherit to all child subscriptions
Assign RBAC roles at management group for multiple subscriptions
View costs, compliance, and usage across multiple subscriptions
Mirror your business structure in Azure for better governance
ContosoTenant (Auto-Created)
GlobalBank Corp: 50,000 employees, operations in 30 countries, 200+ Azure subscriptions, strict financial regulations (SOX, PCI-DSS, Basel III), complex organizational structure with multiple business units.
Enterprise security baseline, encryption requirements, audit logging
North-America-MG, Europe-MG, Asia-Pacific-MG (data residency rules)
RetailBanking-MG, CommercialBanking-MG, Investment-MG (different compliance rules)
Production-MG, NonProduction-MG (different security requirements)
Grant minimum permissions needed for users to perform their jobs
Assign roles to Azure AD groups for easier management and auditing
Periodically review and clean up permissions, especially for departing employees
Understand how permissions inherit down the management hierarchy
Proper organization and tagging of Azure resources is like having a well-organized library - it makes finding what you need quick and easy while enabling powerful automation, cost management, and governance capabilities. Tags are name-value pairs that provide metadata about your resources, enabling you to categorize resources for billing, management, and operational purposes.
Essential for chargeback billing and cost reporting
Critical for operations and automation
Know who to contact for issues or approvals
Essential for regulatory compliance and security
Generate detailed cost reports by department, project, or cost center for accurate billing allocation.
Automatically start/stop VMs based on environment tags, apply security policies based on data classification, trigger backups based on criticality tags.
Quickly find all resources belonging to a project, all production databases, or all resources owned by a specific team.
Generate compliance reports, track data classification requirements, identify resources subject to specific regulations.
Prevents deletion of the resource but allows read and modify operations.
Prevents deletion and modification but allows read operations only.
Apply CannotDelete locks to all production resource groups to prevent accidental environment deletion.
Apply ReadOnly locks to backup storage accounts and archive data during compliance periods.
Lock shared networking resources like VPN gateways and core virtual networks.
Establish clear procedures for emergency lock removal with approval workflows.
Successful Azure deployments follow proven organizational patterns and governance practices. These best practices help ensure security, compliance, cost control, and operational efficiency at scale while maintaining flexibility for growth and change.
Organizational Structure
Identity & Permissions
Financial Control
Policy & Compliance
Day-to-Day Management
People & Processes
Outstanding! You now understand how to organize and manage Azure resources at enterprise scale. With proper hierarchy, access control, and governance in place, you're ready to explore the compute services that will run your applications. Next, we'll dive into Azure Virtual Machines and compute options.