Azure Subscriptions and Management Groups

Azure uses a hierarchical structure to organise resources, enforce policies, and manage billing. At the top of this hierarchy sit management groups, which contain subscriptions, which in turn contain resource groups and resources. Understanding this hierarchy is critical for governance, cost control, and security in any Azure environment.

---

Azure Subscriptions

An Azure subscription is a logical unit that serves two primary purposes:

1. Billing boundary — all costs incurred by resources within a subscription are billed together on a single invoice
2. Access-control boundary — you can assign Azure RBAC roles at the subscription level to control who can manage resources

Every Azure resource belongs to a resource group, and every resource group belongs to a subscription. You cannot create resources without a subscription.

Types of Subscriptions

Azure offers several subscription types:

Type	Description
Free Account	$200 credit for 30 days, plus free-tier services for 12 months
Pay-As-You-Go	No upfront commitment; you pay for what you use
Enterprise Agreement (EA)	Large organisations negotiate a bespoke agreement with Microsoft
Microsoft Customer Agreement (MCA)	A modern agreement structure for direct and partner purchases
CSP (Cloud Solution Provider)	Purchased through a Microsoft partner who manages billing
Visual Studio / Dev Essentials	Subscriptions bundled with Visual Studio licences, including monthly Azure credits

Why Use Multiple Subscriptions?

Many organisations use multiple Azure subscriptions to:

• Separate environments — production, staging, and development each in their own subscription
• Separate billing — different departments or projects can be billed independently
• Isolate workloads — high-security workloads can be isolated from general-purpose workloads
• Manage service limits — each subscription has default quotas (e.g., maximum number of VMs per region). Using multiple subscriptions avoids hitting these limits.
• Apply different policies — governance policies can be applied at the subscription level

Subscription Limits

Each subscription has default limits (also called quotas) on various resources. For example:

• Maximum of 25,000 VMs per region per subscription
• Maximum of 980 resource groups per subscription
• Maximum of 800 deployments per resource group

These limits can usually be increased by raising a support request with Microsoft.

---

Management Groups

Management groups provide a level of governance above subscriptions. They allow you to organise subscriptions into a hierarchy and apply policies and access controls that cascade down to all subscriptions and resources within the group.

The Management Group Hierarchy

At the very top is the root management group, which is created automatically for every Azure Entra ID tenant. All subscriptions and other management groups ultimately sit under this root.

Root Management Group
├── IT Department (Management Group)
│   ├── Production (Subscription)
│   └── Development (Subscription)
├── Marketing (Management Group)
│   └── Marketing Apps (Subscription)
└── Finance (Management Group)
    └── Finance Apps (Subscription)

Key Rules

1. A single directory can support up to 10,000 management groups
2. The hierarchy can be up to 6 levels deep (not including the root or the subscription level)
3. Each management group or subscription can have only one parent
4. Each management group can have multiple children (subscriptions or other management groups)
5. Policies and RBAC assignments applied to a management group are inherited by all child management groups and subscriptions

Why Use Management Groups?

Management groups are essential for large organisations that need to: