Azure Fundamentals: Tenants, Subscriptions, and Resource Groups

Azure starts with scope, not service names

Azure is Microsoft's cloud platform for running applications, storing data, connecting networks, managing identities, and operating business systems. The useful beginner question is not how many Azure services exist. It is where a resource belongs, who may manage it, how traffic reaches it, and who pays for it.

A web app is not simply in Azure. It belongs to a resource group inside a subscription, is associated with a Microsoft Entra tenant, runs in one or more locations, and is governed through Azure Resource Manager.

This lesson builds that map before asking you to create anything chargeable. Once the hierarchy and request path make sense, individual Azure services stop looking like unrelated portal screens.

1. The Azure hierarchy

Azure Resource Manager organizes resources into scopes. Role assignments and Azure Policy controls applied at a higher scope can affect child scopes, so hierarchy design controls both governance reach and mistake radius.

Scope	Primary purpose	Architecture question
Microsoft Entra tenant	Identities, applications, and authentication	Which organization owns the identities?
Management group	Governance across subscriptions	Which policies should many subscriptions inherit?
Subscription	Billing, quota, resource, and access boundary	Should production and development be isolated?
Resource group	Lifecycle, deployment, tagging, and access container	Which resources share an owner and lifecycle?
Resource	An individual service instance	What configuration does this workload component need?

2. Resource groups are lifecycle containers

A resource group is not a network or disk folder. Use it for resources that should be deployed, governed, observed, and removed together. Resources in one group may use different Regions, but each resource belongs to only one resource group at a time.

Deleting a resource group starts deletion of its contained resources. Production groups therefore need clear ownership, appropriate locks, backups, and an infrastructure-as-code definition.

Group by workload lifecycle rather than by service type alone.
Use tags for ownership and allocation, not as a substitute for real access boundaries.
Check whether a resource supports moving before reorganizing a live environment.

3. Regions, zones, and geography

Region choice affects latency, data residency, service and SKU availability, network transfer, recovery options, capacity, and price. Availability Zones isolate facilities within supported Regions, while a secondary Region addresses a broader failure class.

A zonal resource is not automatically resilient to a zone failure. The complete request path, including entry, compute, data, identity dependencies, and operations, must use the intended redundancy.

Verify service, feature, and SKU support in the chosen Region.
Define recovery time and recovery point objectives before buying redundancy.
Treat replication, backup, and tested restore as separate protections.

4. Control plane and data plane

Azure Resource Manager handles control-plane actions such as creating a storage account or resizing a virtual machine. Reading blobs, querying a database, or calling an application endpoint uses a data-plane path and may require different permissions and networking.

This is why a person can view a storage account in the portal yet receive an authorization error when opening a blob. Portal visibility does not prove data access.

Need	Primary evidence	Typical control
Who changed a resource?	Azure Activity Log	Azure RBAC on a Resource Manager scope
Who read or changed service data?	Service diagnostic or audit logs	Data-plane role and service authorization
Can traffic reach the endpoint?	Network and application telemetry	DNS, routes, NSGs, firewalls, and private endpoints

5. One application seen as a request path

Consider an employee expense application. Microsoft Entra ID signs in users, Front Door or Application Gateway accepts traffic, App Service or Container Apps runs code, Azure SQL stores transactions, Key Vault protects secrets, and Azure Monitor collects signals. This is an example, not a mandatory recipe.

Question	Azure candidates	Trade-off
Who is calling?	Entra ID, managed identities, workload identity federation	Human versus workload identity and least privilege
Where does code run?	Virtual Machines, App Service, Functions, Container Apps, AKS	Control, constraints, scaling, and operational effort
Where does state live?	Storage, Azure SQL, Cosmos DB, PostgreSQL, Managed Disks	Data model, consistency, durability, and recovery
How will operators know?	Azure Monitor, Log Analytics, Application Insights, Activity Log	Metrics, logs, traces, alerts, audit, and retention

6. Guided portal tour without creating resources

Sign in with your normal Entra account and use a lab subscription. This tour is read-only so you can learn scope controls before a Create action changes a shared environment or starts a bill.

Step	Why	Expected result
1. Open Directories and subscriptions	Confirm tenant and subscription context	The selected directory and subscription match the intended lab.
2. Open Subscriptions	See billing, access, policy, and quota boundaries	You can identify the subscription name and ID.
3. Open Resource groups	See workload lifecycle containers	You can inspect location metadata, tags, and resource counts.
4. Open one resource group	Connect services to a workload	Overview lists resources; Activity log lists control-plane events; Access control lists role assignments.
5. Open Cloud Shell where enabled	Use an authenticated CLI environment	az account show returns the same tenant and subscription you saw in the portal.
6. Open Cost Management	Introduce financial ownership	You can inspect allowed cost views or identify the separate access you need.

7. Identity, RBAC, Policy, and locks are different controls

Azure operates the physical cloud and managed platform layers. You still own identities, data, code, configuration, and the portions of the operating system exposed by the selected service. A virtual machine leaves more operational work with you than App Service or Azure SQL.

Control	Question answered	Common mistake
Microsoft Entra ID	Who or what is the identity?	Shared accounts or long-lived application secrets
Azure RBAC	What may the identity do at this scope?	Owner or Contributor at subscription scope for convenience
Azure Policy	Which resource configurations are allowed or audited?	Assuming Policy grants user access
Resource lock	Should accidental delete or change be blocked?	Treating a lock as protection from a sufficiently privileged administrator

8. Real-world adoption and when to pause

Scenario	Why Azure may fit	Boundary to investigate
Microsoft-centered enterprise app	Entra identity, managed compute and data, and Azure governance integrate with existing operations	Licensing, directory ownership, network connectivity, and support skills
Public web or API workload	Managed application platforms reduce infrastructure work	Traffic, state, regional support, scaling tests, and rollback
Hybrid datacenter extension	VPN, ExpressRoute, Arc, and identity integration connect estates	Overlapping addresses, latency, dependency direction, and outage behavior
Analytics platform	Azure storage and managed analytics services support varied workflows	Classification, residency, retention, access, and query cost

9. Common mistakes, cost, and troubleshooting

When something fails, do not immediately add Owner access or open the network to everyone. Classify the problem as tenant, subscription, Region, authorization, Policy, resource state, network path, application behavior, capacity, or service health.

Symptom	Check first	Evidence
Resource appears missing	Directory, subscription filter, resource group, and Region	az account show, resource ID, portal scope, and Activity Log
AuthorizationFailed	Principal, RBAC scope, deny assignment, Policy, and token age	Exact operation, scope, correlation ID, and Activity Log
Application cannot connect	DNS, routes, NSGs, firewall, private endpoint, and target health	Connection test, Network Watcher data, logs, and trace
Unexpected bill	Cost by subscription, resource group, resource, service, location, and meter	Cost analysis, tags, inventory, recent changes, and owner

Estimate compute, disks, databases, gateways, public IPs, operations, logs, and data transfer.
Delete unused lab resources; stopping compute may leave chargeable dependencies.
Record UTC timestamps, correlation IDs, and one tested hypothesis at a time.

10. Production recommendations

A production subscription needs documented ownership, central identity, policy guardrails, diagnostic settings, cost allocation, repeatable deployment, tested recovery, and incident procedures. A working portal deployment is only the beginning.

Separate production, nonproduction, connectivity, identity, and security concerns where stronger boundaries are justified.
Use managed identities and narrowly scoped roles instead of embedded secrets and broad access.
Store infrastructure, Policy, dashboards, and alerts in version control where practical.
Test service limits, scaling, zone behavior, backup restore, deployment rollback, and secret rotation before launch.
Use Azure Well-Architected and Cloud Adoption guidance as review prompts, not replacements for workload requirements.

Azure Scope Examples

Verify Azure CLI scope before a change

These read-only commands confirm the active cloud, tenant, subscription, and visible resource groups.

Verify Azure CLI scope before a change

az cloud show --query "{cloud:name,profile:profile}"
az account show --query "{subscription:name,subscriptionId:id,tenantId:tenantId,user:user.name}" --output table
az group list --query "[].{name:name,location:location}" --output table

Set the intended subscription explicitly before automation instead of trusting an old default.
The resource group location stores group metadata; contained resources may use other supported Regions.

Write the Azure resource path before building

This small design note exposes missing scope, identity, telemetry, and recovery decisions.

Write the Azure resource path before building

Tenant: Contoso workforce directory
Management group: Corp / Online
Subscription: Online-Production
Resource group: rg-orders-prod-westindia

Request: Front Door -> App Service -> Azure SQL
Identity: App Service managed identity -> database
Operations: Application Insights + Azure Monitor alerts
Recovery: RTO 60 minutes; RPO 15 minutes; restore tested quarterly

A proficient review adds traffic, quota, cost, data classification, and failure assumptions.
Dedicated service pages turn each decision into a hands-on deployment.

Before you move on