Microsoft Azure Explained: Subscriptions, Resource Groups, and Core Services
How Microsoft Azure is structured: Entra ID tenants, subscriptions, resource groups, Azure RBAC, regions and availability zones, core compute, storage, database, and AI services, plus billing, budgets, and quotas.
Microsoft Azure uses a layered structure that differs from AWS and Google Cloud, and most early mistakes come from not knowing where a tenant ends and a subscription begins. This guide explains the tenant, management group, subscription, and resource group hierarchy, how Azure role-based access control works, how regions and availability zones are laid out, how billing and quotas behave, and which services cover the majority of workloads.
Tenants, subscriptions, and resource groups
At the top sits the Microsoft Entra ID tenant (previously called Azure Active Directory). The tenant is the identity directory: it holds users, groups, applications, and sign-in policies. One organisation normally has one tenant, and that tenant can be trusted by many subscriptions.
A subscription is the billing and quota boundary. Every resource belongs to exactly one subscription, usage is invoiced per subscription, and service limits are counted per subscription per region. Subscriptions come in several offer types: the free account, pay-as-you-go, Visual Studio and developer benefits, Enterprise Agreement, and Cloud Solution Provider. The offer type determines how you are billed and which support and pricing terms apply.
Inside a subscription, resources live in resource groups. A resource group is a logical container, not a boundary for networking or billing. It is where you apply tags, lock resources against accidental deletion, and delete an entire application in one action. Management groups sit above subscriptions and let you apply policy and access across many subscriptions at once.
- Tenant
- Microsoft Entra ID directory holding identities and sign-in policy
- Management group
- Optional container that applies governance across subscriptions
- Subscription
- Billing, quota, and access boundary for resources
- Resource group
- Logical container for resources that share a lifecycle
Identity and access with Azure RBAC
Azure role-based access control (RBAC) assigns a role to a security principal at a scope. The principal can be a user, a group, a service principal, or a managed identity. The scope can be a management group, a subscription, a resource group, or a single resource, and assignments inherit downwards. Built-in roles such as Owner, Contributor, and Reader cover most cases, and each service publishes narrower roles such as Storage Blob Data Reader or Virtual Machine Contributor.
Managed identities are the Azure answer to stored credentials. A virtual machine, function app, or container can be given an identity that Azure manages, and that identity is granted RBAC roles or access to Key Vault secrets without any password in configuration. Azure Policy complements RBAC by enforcing rules on what can be created, for example restricting regions or requiring tags.
Regions, availability zones, and region pairs
Azure has one of the largest region footprints of any provider. Many regions contain availability zones: physically separate locations within the region with independent power, cooling, and networking. Zone-redundant services such as zone-redundant storage or a zone-redundant load balancer spread data or capacity across zones automatically. Not every region has zones, so check before you design for them.
Azure also groups most regions into pairs within the same geography, for example two regions in the same country. Some services use the pair for geo-redundant storage replication and for staged platform updates. Region choice affects available VM series, pricing, compliance boundaries, and whether a particular managed service has launched there. Certain specialised regions, such as government or sovereign clouds, require separate enrolment.
Core services grouped by job
| Category | Services | Notes |
|---|---|---|
| Compute | Virtual Machines, Virtual Machine Scale Sets, Azure Kubernetes Service, App Service, Azure Functions, Container Apps | VM series for general, compute, memory, storage, and GPU workloads; managed Kubernetes; web hosting PaaS; event-driven functions; serverless containers |
| Storage | Blob Storage, Managed Disks, Azure Files, Data Lake Storage | Object storage with hot, cool, cold, and archive tiers; block storage for VMs; SMB and NFS file shares |
| Databases | Azure SQL Database, Azure Cosmos DB, Azure Database for PostgreSQL and MySQL, Azure Cache for Redis | Managed SQL Server, a multi-model globally distributed database, open-source engines, and caching |
| Networking | Virtual Network, Network Security Groups, Load Balancer, Application Gateway, Front Door, Azure DNS | Regional private networks with subnets, stateful firewall rules, layer 4 and layer 7 load balancing, and global edge delivery |
| AI | Azure OpenAI Service, Azure AI Foundry, Azure AI Services, Azure Machine Learning | Access to OpenAI and other models with per-deployment token limits; a unified development portal; prebuilt vision, speech, and language APIs; model training |
| Operations and security | Azure Monitor, Log Analytics, Key Vault, Microsoft Defender for Cloud | Metrics, logs, and alerts; secret and certificate storage; security posture management |
Azure’s strongest pull is integration with the Microsoft stack. Windows Server and SQL Server licences can be brought to Azure through Azure Hybrid Benefit, Entra ID connects to on-premises Active Directory, and Microsoft 365 shares the same tenant. On the AI side, Azure OpenAI Service deployments are created per region with quota expressed in tokens per minute, and availability of individual models varies by region. The service reference for everything above is in the Azure documentation.
Billing, quotas, and practical considerations
Pay-as-you-go is the default model: usage is metered and invoiced monthly against the payment method on the subscription. For steady workloads, Reserved Instances and Azure savings plans for compute offer discounts in exchange for a one-year or three-year commitment, and Spot Virtual Machines offer unused capacity at reduced prices with the possibility of eviction. The Azure free account gives new customers a credit and a set of free services for a limited period; the amount and conditions are set by Microsoft and change over time, so confirm them on the current offer page.
Cost Management and Billing is the console area for invoices, cost analysis, and budgets. A budget applies to a subscription or resource group and triggers alerts at the percentages you set. Alerts can also fire an action group, which is how teams automate a response such as stopping development VMs.
Quotas are per subscription and per region. The most visible is the regional vCPU quota, which is further split by VM family (for example Dsv5 or Esv5). New pay-as-you-go subscriptions start with modest limits, and increases are requested from the Quotas page in the portal, where Microsoft reviews them. Trial subscriptions are typically more restricted than upgraded ones. Before you rely on Azure for production, work through this list:
- Confirm the subscription offer type and payment method, and upgrade a free trial to pay-as-you-go if you need capacity beyond trial limits.
- Create a budget with alerts before deploying, and tag resource groups by owner and environment.
- Check the vCPU quota for the VM family and region you intend to use and file increases early.
- Follow the Microsoft Online Services terms and acceptable use policy. Unsolicited email, cryptocurrency mining on trial credit, and abusive network activity lead to subscription suspension.
- Turn on Azure Monitor alerts and Defender for Cloud recommendations so misconfigurations surface quickly.
Where to go next
Subscription listings labelled by trial status, pay-as-you-go, credit balance, or AI support are on the Buy Azure Accounts product page.
Related reading in the Cloud Library:
- What is a cloud account? Organizations, projects, billing, and access
- Pay-as-you-go vs reserved and committed pricing in the cloud
- Setting budgets and billing alerts on any cloud provider
- Serverless functions compared: Lambda, Cloud Functions, and Azure Functions
- Cloud account security essentials: MFA, roles, and least privilege
Browse the full Cloud Library, or compare platforms on the AWS vs Azure page.