Azure subscription
What it is
An Azure subscription is a logical container and a billing, quota, and access boundary for Azure resources. Most application resources are deployed in one subscription, and an organization can use many subscriptions. A few Azure resource types live at a management-group or tenant scope, so “every Azure object is in a subscription” is a useful beginner model, not an absolute rule.
Why it exists
When you sign up for Azure you consent to a subscription and pay for the resources inside it. Subscriptions give you a way to separate environments, teams, and cost so you can govern, bill, and limit each one independently while all of it is administered centrally.
How it works
- Billing and quotas: usage is charged to a subscription, and service limits can be applied per subscription. A subscription is not a credit card, nor is it a geographic location.
- Identity and access: a subscription trusts one Microsoft Entra tenant. The tenant contains identities; Azure RBAC determines what those identities can do in the subscription.
- Organization: Management groups organize subscriptions and can pass policy or RBAC assignments down to them. A subscription contains resource groups and resources.
- Separation: use separate subscriptions when an environment, owner, billing, quota, or compliance boundary must be genuinely separate. A naming convention alone does not create that boundary.
Northwind example
Northwind uses northwind-production for real orders and northwind-lab for experiments. Priya can report production costs separately, Maya can apply stricter production policy, and an accidental lab deployment does not consume the production subscription’s budget or quota. Luis may still have access to both, but only through explicit or inherited RBAC assignments.
Common confusion
- A subscription is not the same as a tenant: the tenant provides the directory of identities, while the subscription provides the resource and billing boundary.
- A subscription is not a resource group: a subscription can contain many resource groups with independent lifecycles.
- Moving a subscription under another management group changes inherited governance. It does not itself move workloads or change their Azure region.
How it fits (diagram)
Failure modes and tradeoffs
- Too few subscriptions can mix sensitive production access, costs, and quotas with experiments.
- Too many subscriptions can make policy, networking, billing, and operations harder to coordinate.
- Subscription transfer and resource moves have service-specific requirements. Confirm those requirements before designing a move as a recovery plan.
Related
azure-management-hierarchy · management-groups · resource-group · scope · entraid · cost-management · northwind-traders-case-study
📘 Sources: Microsoft Learn — Azure Resource Manager overview and Subscription, checked 2026-09-16. Re-audit when subscription administration or billing ownership changes.