Azure management hierarchy

What it is

The usual Azure picture has two connected parts:

Microsoft Entra tenant  → identity directory: people, groups, applications
                            │ trusts identities for access
Management group → Subscription → Resource group → Resource
  governance          billing,        lifecycle       the thing you use
  scope               quota, access

The tenant is the identity directory. Azure management scopes are management group, subscription, resource group, and resource. A management group organizes subscriptions; a subscription is a billing, quota, and access boundary; a resource group groups resources that share a lifecycle; a resource is a manageable Azure item, such as a VM, storage account, or virtual network.

Why it exists

Each level answers a different question. “Who may sign in?” belongs to the tenant. “Which subscriptions need the same guardrail?” belongs to a management group. “Which costs and quotas must be separate?” belongs to a subscription. “Which components are deployed and retired together?” belongs to a resource group.

Boundaries and handoffs

Settings applied high in the management-scope hierarchy normally apply below them. For example, a policy at a management group can limit VM locations in every descendant subscription. A role at a resource group can let Luis manage Northwind’s ordering application without giving him access to every subscription.

Azure Resource Manager receives management requests such as “create a storage account.” It checks authorization, policy, and locks before the resource provider acts. A data-plane operation, such as reading a blob, is separate: someone may be allowed to configure a storage account but not read its files.

Northwind example

Northwind keeps Maya, Luis, and Priya’s accounts in its Entra tenant. Its Production management group holds the northwind-production subscription. Inside it, orders-production is a resource group containing the web app, storage account, and monitoring resources that the orders team changes together. The web app is one resource. A different northwind-lab subscription keeps experiments separate from customer costs and access.

Common confusion

• A tenant is not a subscription. One tenant can be associated with many subscriptions.
• A resource group is not a physical datacenter or a network boundary. Its own location stores management metadata; its resources can be in different regions.
• A resource usually belongs to one resource group and one subscription, but some resource types are deployed at subscription, management-group, or tenant scope. Do not turn that exception into a design rule.
• An inherited policy or role is not a label. It changes what descendants can do or deploy.

Route and sources

Learn this in AZ-900 architecture, then apply it in AZ-104 foundation.

• Azure Resource Manager overview, checked 2026-08-31.
• Azure management groups, checked 2026-08-31.

Re-audit when management scopes, inheritance, or control/data-plane authorization changes.

Related

northwind-traders-case-study · tenant · management-groups · subscription · resource-group · scope · rbac · azure-policy