Azure subscription
What it is
An Azure subscription is a logical container for Azure resources and the billing (cost) boundary for them. Every resource you deploy belongs to exactly one subscription, and you may have many subscriptions. A subscription is also a boundary for access management and resource limits/quota.
Why it exists
When you sign up for Azure you consent to a subscription and pay for the resources inside it. Subscriptions give you a way to separate environments, teams, and cost so you can govern, bill, and limit each one independently while all of it is administered centrally.
Key ideas
- Container + boundaries — a subscription is simultaneously a resource container, an accounting/billing unit, and an access boundary with per-subscription service quotas (limits).
- Trusts an Entra ID tenant — each subscription is trusted by one Microsoft Entra ID (tenant). The tenant holds the identities; the subscription holds the resources those identities may access (subject to RBAC).
- Exactly one target — every resource lives in exactly one subscription (and exactly one resource-group).
- Multiple subscriptions — used for environments (dev/test/prod), billing separation, or compliance; often organized under management groups.
- One Account Administrator owns billing; Service Administrators / RBAC roles control resources.
How it fits (diagram)
Exam notes
- One resource → one subscription → one resource group. Nothing exists outside a subscription & RG.
- Subscription = billing + access + resource-limit (quota) boundary. Its purpose is NOT performance/geography.
- Subscription trusts a tenant for authentication; it is not the same thing as the tenant.
- You can move a subscription between management groups; transfer billing ownership.
Related
Path MOC · management-groups · resource-group · scope · entraid · cost-management
📘 Source: Microsoft Learn — Subscription