Module 2 — Azure architecture and resource hierarchy
Place in the route
Study this after cloud responsibility. It explains where Azure resources live and which boundary controls them.
Outcomes
You should be able to distinguish datacenters, regions, availability zones, region pairs, sovereign regions, subscriptions, resource
groups, and management groups, and explain the hierarchy tenant → management group → subscription → resource group → resource.
Geography and failure boundaries
An Azure region is a geographic deployment area containing one or more datacenters connected by Azure’s network. Availability zones are physically separate datacenter groupings within a supported region; placing redundant instances across zones reduces the chance that one datacenter failure takes them all offline. A region pair is a Microsoft-defined relationship between regions used by some platform recovery and update strategies; it is not an automatic backup of every workload. Sovereign regions are separate Azure environments built for special legal or operational boundaries.
Choose a region using service availability, user latency, data residency, and resilience requirements. Do not assume that selecting a region pair creates application recovery: the application must still replicate data, deploy a second environment, and test recovery.
The management hierarchy
A tenant is the identity directory boundary. A subscription is an Azure management, billing, quota, and access boundary that trusts a tenant. Management groups organize subscriptions for inherited governance. A resource group is a lifecycle-oriented container inside one subscription; its resources may be in different regions. A resource is the deployable service instance, such as a storage account or VM.
Azure Resource Manager (ARM) receives control-plane requests to create or change resources. A service’s data plane handles operations on the data after deployment. An administrator may be allowed to change a storage account through ARM yet be denied access to read blobs; these are separate authorization decisions.
Worked scenario
Put a production web app and its database in a resource group because they share deployment and deletion lifecycle. Put production and development subscriptions under a management group when both need common policy but separate billing and access. Put the workload near users, then add zone or regional design only when the failure and data-recovery requirements justify the cost and complexity.
See azure-management-hierarchy for the canonical scope and control/data-plane explanation.
Conceptual checkpoint
Explain why a resource group’s region does not relocate the resources it contains, why a subscription is not a tenant, and what must be added to a region-pair design before it can recover an application.
Hands-on / what to try
Draw the hierarchy and annotate each boundary with its owner, billing/access role, and inheritance behavior. Validate the diagram against the AZ-900 Canvas map.
Sources and re-audit
- AZ-900 course, checked 2026-08-31.
- AZ-900 study guide, skills measured 2026-07-20, checked 2026-08-31.
- Azure regions and availability zones, checked 2026-08-31.
- Azure Resource Manager overview, checked 2026-08-31.
Re-audit when Azure geography, management-scope, or control/data-plane behavior changes.