Azure Subscriptions
A beginner-friendly guide to the container that holds your Azure resources, receives your bill, and sets the boundaries for access, limits, and rules, plus how to organize many of them wisely.
Imagine you join a big company and receive a work credit card, a badge, and a desk. The card decides who pays, the badge decides which doors you may open, and the desk is where your work lives. In Azure, a subscription plays all three roles at once. It is the place where your resources sit, the account that gets billed, and a boundary that decides who can do what inside it.
Almost everything you build in Azure begins with a subscription, yet beginners often skip over it and later wonder why bills are confusing or why a teammate cannot see a resource. This guide starts from zero. Every new word is explained when it first appears, we use everyday comparisons, and we build up until you can design a sensible subscription layout for a real company.
1What an Azure Subscription Is
A simple definition first, then the three jobs it performs.
An Azure subscription is a logical container that holds your Azure resources and links them to a billing arrangement. A resource is any single thing you create in Azure, such as a virtual machine, a database, a storage account, or a website. You cannot create a resource without choosing a subscription to place it in.
Each subscription is identified by a long unique number called a subscription ID, and also has a friendly name that you can change. The ID never changes, which makes it useful for automation and for support conversations.
The three jobs of a subscription
Billing boundary
Usage and costs are measured and invoiced per subscription, so you can see exactly what each one spent.
Access boundary
Permissions can be given at the subscription level, so a team can be trusted with everything inside one subscription and nothing outside it.
Scale and limit boundary
Many service limits, called quotas, are counted per subscription, so splitting work across subscriptions can raise your total room to grow.
Think of a subscription as a separate prepaid mobile phone connection for each family member. Each connection has its own bill, its own limit, and its own owner. If one person overspends, the others are unaffected. You can look at each bill separately and know whose it is.
A subscription does not run anything by itself. It is a container and a boundary. The real work is done by the resources you place inside it.
2Where Subscriptions Fit: The Big Picture
Azure organizes everything in a tree. Learn the levels from top to bottom.
At the very top of your organization’s identity sits a tenant. A tenant is a dedicated, private instance of Microsoft Entra ID, the cloud identity service that stores your users, groups, and sign-in rules. Each subscription trusts exactly one tenant for identity. Many subscriptions can trust the same tenant.
Beneath the tenant, you may create management groups, which are folders for subscriptions. Rules placed on a management group flow down to every subscription inside it. Inside each subscription are resource groups, which are folders for resources, and inside those are the resources themselves.
flowchart TD
TEN["Tenant - Microsoft Entra ID - users and groups"] --> ROOT["Root Management Group"]
ROOT --> MGP["Management Group - Production"]
ROOT --> MGD["Management Group - Development"]
MGP --> SUB1["Subscription - Web Shop Production"]
MGP --> SUB2["Subscription - Shared Networking"]
MGD --> SUB3["Subscription - Web Shop Development"]
SUB1 --> RG1["Resource Group - Application"]
SUB1 --> RG2["Resource Group - Data"]
RG1 --> RES1["Web App"]
RG2 --> RES2["Database"]
| Level | What it is | Main purpose |
|---|---|---|
| Tenant | Your organization’s identity directory | Who the people and programs are |
| Management group | A folder for subscriptions | Apply rules and access to many subscriptions at once |
| Subscription | Billing and boundary container | Bills, quotas, and a major access scope |
| Resource group | A folder for related resources | Group items that share a life cycle |
| Resource | A single Azure item | The actual service doing the work |
A large university has one central register of all students and staff, which is the tenant. Faculties are management groups. Each department has its own budget, which is a subscription. Each department keeps project folders, which are resource groups, holding individual documents, which are resources.
3Types of Subscriptions and How You Pay
Subscriptions come with different commercial arrangements, called offers.
An offer is the agreement that decides how a subscription is priced, who is invoiced, and which benefits apply. The list of offers changes over time, so treat the descriptions below as a beginner’s map and confirm current details on Microsoft’s pages.
Free account
New customers can usually try Azure with a starting credit for a limited time plus some services that stay free within limits. Check the current offer, because terms change.
Pay-as-you-go
No commitment. You are billed for what you use, usually on a credit card, at standard prices.
Visual Studio benefits
Monthly credits for people with qualifying developer subscriptions, meant for development and testing, not for production.
Student programs
Free credits or services for eligible learners, without a credit card in many cases.
Enterprise Agreement
A contract for big organizations with a commitment and negotiated pricing, invoiced centrally.
Microsoft Customer Agreement
A simpler, newer agreement style that is signed online and is used for many purchases directly from Microsoft.
Cloud Solution Provider
You buy Azure through a Microsoft partner, who often handles billing and first-line support.
Sponsorship and special programs
Credits granted for start-ups, events, or research for a limited time.
Credits and free offers usually have an end date and a spending cap. When credits run out or expire, resources may be disabled until you upgrade to a paid subscription. Read the terms before relying on a free offer for anything important.
Billing structure behind the scenes
Subscriptions connect to a billing account, which represents your commercial relationship with Microsoft. Depending on the agreement, a billing account can contain billing profiles, which decide how invoices are produced and paid, and invoice sections, which group costs, for example by department. Subscriptions are placed under these so that each team’s costs land on the right invoice line.
flowchart TD
BA["Billing Account - agreement with Microsoft"] --> BP["Billing Profile - invoice and payment method"]
BP --> IS1["Invoice Section - Engineering"]
BP --> IS2["Invoice Section - Marketing"]
IS1 --> S1["Subscription - Engineering Production"]
IS1 --> S2["Subscription - Engineering Development"]
IS2 --> S3["Subscription - Marketing Website"]
4Subscriptions and Identity: Tenants and Trust
Who may sign in, and who may act inside a subscription?
Every subscription trusts one tenant to answer the question “who is this person?” That tenant holds the accounts. A second question then follows: “what is this person allowed to do here?” That answer is given by Azure role-based access control, or RBAC, which lives inside the subscription’s own scopes.
Roles at subscription level
You assign a role to a person, a group, or an application at a chosen scope. A scope is the level where the role applies. If you assign a role at subscription scope, it applies to everything inside that subscription.
| Role | What the holder can do |
|---|---|
| Owner | Everything, including giving access to other people |
| Contributor | Create and manage resources but not give access to others |
| Reader | See everything but change nothing |
| User Access Administrator | Manage who has access, without managing the resources themselves |
| Billing-related roles | See or manage costs and invoices, depending on the role |
The golden rule is least privilege, which means giving each person only the access they need and nothing more. A developer rarely needs to be an Owner of a whole production subscription.
Moving a subscription between tenants
Sometimes a subscription must change which tenant it trusts, for example after a company merger. This is possible, but it is a serious operation. Role assignments and some features that depend on the old directory may be lost or must be recreated afterward. Plan it carefully, test in a non-critical subscription first, and read Microsoft’s current guidance.
Owning a subscription on the billing side is not the same as being allowed to manage its resources. Billing roles and Azure resource roles are separate, so someone who pays the bill may not automatically have rights to the machines.
5How a Subscription Works Internally
What happens when you create something inside a subscription?
When you press Create in the Azure Portal, the request travels to Azure Resource Manager, the central management service of Azure. Resource Manager checks several things that are tied to your subscription before any real work begins.
sequenceDiagram
participant U as You
participant A as Azure Resource Manager
participant I as Entra ID and RBAC
participant P as Azure Policy
participant Q as Quota and Provider Check
participant R as Resource Provider
U->>A: Create a virtual machine in Subscription X
A->>I: Who is this and what role do they hold here?
I-->>A: Allowed at this scope
A->>P: Do company rules allow this?
P-->>A: Compliant
A->>Q: Is the resource provider registered and quota available?
Q-->>A: Yes
A->>R: Create the resource
R-->>A: Done
A-->>U: Deployment succeeded
Resource provider registration
Each Azure service is delivered by a resource provider. Before a subscription can use a service, the matching provider must be registered in that subscription. Many common ones are registered automatically, but some must be switched on by hand. A common beginner error message says that the subscription is not registered to use a namespace. The fix is to register the provider, which needs a role that allows it.
Quotas and limits
A quota is a limit on how much of something a subscription may use, such as the number of virtual machine processor cores in a region. Quotas exist to protect both Microsoft and customers from accidental runaway usage. Many quotas can be raised by sending a request through the portal. Others are fixed hard limits of the platform. New or trial subscriptions often start with lower limits.
Your electricity connection at home has a maximum load. You can plug in many devices, but if you try to run too many heavy ones together, the supply cuts off. A quota is that maximum for your cloud connection. You can ask the provider for a bigger connection if you have a good reason.
6The Life Cycle of a Subscription
Subscriptions are born, live, and can be paused or ended.
Create
A subscription is created under a billing arrangement and linked to a tenant. It starts in an active state.
Set up
Name it clearly, place it in a management group, assign roles, register providers, apply policies, and set a budget.
Use
Teams create resource groups and resources, and costs accumulate in the billing view.
Adjust
Change names, move resources, raise quotas, switch plans, or transfer billing ownership as the business changes.
Disable or cancel
A subscription can become disabled, for example due to an unpaid bill, expired credit, or a cancellation by the owner. Resources stop working.
Retention and deletion
After cancellation there is a waiting period before final deletion, during which recovery may be possible. After that, the data is gone for good.
Common states
| State | Meaning in simple words |
|---|---|
| Active | Everything works normally |
| Warned or past due | There is a billing or compliance problem that needs attention soon |
| Disabled | Reading may still be possible, but running resources are stopped or blocked |
| Expired | A time-limited offer ended |
| Deleted | The subscription and its data are removed |
Cancelling a subscription is not the same as deleting only one resource. Everything inside it is affected. Confirm exports and backups before you cancel, and read the current retention rules because the exact waiting period can differ by offer.
7How Many Subscriptions Do You Need?
A beginner’s most common question has a thoughtful answer.
There is no single right number. A tiny project may use one. A large company may use hundreds or thousands. The key idea is that a subscription is a unit of management and scale. You add subscriptions when you need a separate boundary for cost, access, limits, or rules.
Reasons to use more than one
Separate production from testing
A test mistake can never touch production resources, and production can have tighter rules.
Separate teams or products
Each team sees and pays for its own work, and costs map cleanly to owners.
Avoid hitting limits
Spreading large workloads across subscriptions gives each its own quotas.
Isolate sensitive data
A strictly governed subscription can hold regulated data with extra controls.
Different payment arrangements
Some work may be billed to another cost center or customer.
Limit the blast radius
If one subscription is compromised, damage is limited to that boundary.
flowchart TD
START["New workload to place"] --> Q1{"Is it a different environment, such as production versus test?"}
Q1 -- Yes --> NEW["Use a separate subscription"]
Q1 -- No --> Q2{"Does it have a different owner or billing need?"}
Q2 -- Yes --> NEW
Q2 -- No --> Q3{"Does it need stricter rules or isolation?"}
Q3 -- Yes --> NEW
Q3 -- No --> Q4{"Will it approach quota or scale limits?"}
Q4 -- Yes --> NEW
Q4 -- No --> SAME["Place it in an existing subscription, in its own resource group"]
Creating a subscription is cheap and easy. Untangling resources from an overcrowded subscription later is expensive. When in doubt, lean toward separation and let management groups keep order.
8Common Subscription Layout Patterns
Architects follow a few proven shapes.
Pattern one: by environment
One subscription for development, one for testing, and one for production. This is simple and widely used by small and medium teams. It keeps risky experiments away from live systems.
Pattern two: by workload or application
Each application or product gets its own subscriptions, often with separate ones per environment. Costs and ownership are very clear. This suits organizations with many independent teams.
Pattern three: landing zones
A landing zone is a pre-prepared, well-governed environment where new workloads can “land” safely. It follows common guidance from Microsoft’s Cloud Adoption Framework. Typical layouts include a platform area, holding shared services such as networking, identity, and monitoring, and an application area, holding the workloads.
flowchart TD
ROOT["Root Management Group"] --> PLAT["Platform Management Group"]
ROOT --> LZ["Landing Zones Management Group"]
ROOT --> SBX["Sandbox Management Group"]
PLAT --> ID["Subscription - Identity"]
PLAT --> CONN["Subscription - Connectivity"]
PLAT --> MGT["Subscription - Management and Monitoring"]
LZ --> CORP["Corp - internal apps"]
LZ --> ONL["Online - internet-facing apps"]
CORP --> APP1["Subscription - HR App"]
ONL --> APP2["Subscription - Web Shop"]
SBX --> PLAY["Subscription - Experiments"]
Subscription vending
Large organizations automate the creation of new subscriptions, an idea called subscription vending. A team fills in a request, and an automated process creates a subscription, places it in the right management group, assigns roles, applies policies, sets a budget, and connects it to the network. It works like a vending machine: the request goes in, a ready-to-use subscription comes out.
Production example: large enterprises with many teams
Big companies with hundreds of application teams, including global banks and retailers using Azure, commonly give each application its own subscriptions inside governed management groups. This keeps costs traceable, limits damage from mistakes, and lets central teams apply security rules to everyone at once.
9Governance: Rules, Policies, and Locks
Boundaries are only useful if rules are enforced inside them.
Azure Policy
Azure Policy lets you write rules, such as “only allow these regions” or “storage must not be open to the public,” and apply them to a management group, a subscription, or a resource group. Rules can block a bad action, or simply report non-compliant resources. Because policy flows down the tree, one rule at the management group covers every subscription beneath.
Resource locks
A lock protects a resource, a group, or a subscription against accidental deletion or change. A “delete” lock lets people change a resource but not remove it, and a “read-only” lock stops changes. Locks even stop Owners, until the lock itself is removed, so they act as a final safety net.
Tags
Tags are small name-and-value labels, such as “owner” and “project,” attached to resources or groups. They make cost reports and searches meaningful. Remember that tags do not automatically pass down from a subscription to its resources unless a policy copies them.
Naming
Give subscriptions clear names that show purpose, such as the product, the environment, and sometimes the region or business unit. A name like “Subscription 1” tells nobody anything, and confusion grows with every new one.
Think of a hotel chain. Corporate headquarters sets rules that every hotel must follow, such as fire safety. That is Azure Policy at a management group. Each hotel has its own manager and budget, which is a subscription. Some rooms have a “do not move” sign on valuable furniture, which is a lock.
10Cost Management at the Subscription Level
The subscription is the natural place to watch the money.
Microsoft Cost Management lets you analyze spending by subscription, resource group, service, tag, or location. You can set a budget, which is an amount that triggers warnings as you approach it. You can also view a forecast of the month-end total. A budget alert is like a smoke alarm, not a sprinkler. It tells you about a problem, but by itself it does not necessarily shut anything off, so decide what actions to take.
| Technique | How it helps |
|---|---|
| Budgets and alerts | Warn before spending crosses a limit |
| Tags | Show which owner or project caused each cost |
| Reservations and savings plans | Lower prices when you commit to steady usage, and can be shared across subscriptions or limited to one |
| Right-sizing | Shrink oversized resources using Advisor recommendations |
| Cleanup | Delete unused disks, test machines, and old resources |
| Showback and chargeback | Report costs to teams, or actually bill them internally |
Separate subscriptions make cost reports far easier. When a whole subscription belongs to one team, no tag discipline is needed to know who spent the money.
11Security, Monitoring, and Logging
Protect and observe each subscription as its own unit.
Security
- Protect the accounts. Require multi-factor authentication, where a second proof such as a phone approval is needed besides the password, especially for Owners.
- Limit powerful roles. Keep the number of Owners small, and prefer group-based assignments to individual ones.
- Use just-in-time access. Where available, give powerful roles only for short periods and with approval.
- Turn on Microsoft Defender for Cloud. It checks the subscription’s setup for weaknesses and raises alerts. Some protection plans are enabled per subscription.
- Use managed identities. These give applications an automatic identity so passwords do not have to be stored.
- Keep break-glass accounts. A break-glass account is a carefully protected emergency login that is used only if normal access fails.
Monitoring and logging
Every subscription has an Activity log, a diary of management actions showing who created, changed, or deleted what, and when. Send these logs to a central place, such as a Log Analytics workspace, so you can search across all subscriptions and keep records longer. Azure Monitor gathers metrics, which are numbers over time, and other logs, which are written event records. Set alerts for important events, such as role assignments at subscription level or sudden cost jumps.
An attacker who gains an Owner role on a subscription can create expensive resources, such as many large virtual machines, in minutes. Strong sign-in protection and cost alerts are a pair of defenses that every subscription needs.
12Advantages, Disadvantages, and Trade-offs
More boundaries bring safety and also effort.
Advantages of using several subscriptions
- Clear cost ownership and simple reporting
- Strong isolation between environments and teams
- Separate quotas give more room to grow
- Limits the damage of mistakes or attacks
- Different rules for different sensitivity levels
- Easy to hand a whole subscription to a new owner
Disadvantages and costs
- More things to organize, name, and secure
- Shared services need cross-subscription networking and access
- More roles and policies to keep consistent
- Moving resources between subscriptions can be limited for some resource types
- Without automation, creation can be slow
- Possible duplication of some services
The central trade-off
One giant subscription is easy to start but hard to control later. Hundreds of tiny ones give strong boundaries but need automation and good governance. Most mature organizations choose a middle path with management groups and subscription vending, so scale does not become chaos.
13Anti-Patterns to Avoid
These mistakes appear again and again in real organizations.
What it is
Putting development, testing, and production all in one subscription.
Why it hurts
A careless change or a mistaken deletion in a test area can hit live systems, and costs from all environments blend together.
Better approach
Give production its own subscription with tighter roles, policies, and locks.
What it is
Giving many people the Owner role “to avoid delays.”
Why it hurts
Anyone with Owner can change access, delete anything, and run up huge bills. One stolen account becomes a disaster.
Better approach
Use Contributor or narrower roles, assign them to groups, and reserve Owner for very few people.
What it is
Using a personal account or a personal credit card subscription for company work.
Why it hurts
When the person leaves, the company loses control, and billing and access become tangled.
Better approach
Create subscriptions under the company’s billing account and tenant, and tie access to groups rather than to individuals.
What it is
Creating subscriptions with no naming rule, no owner, and no budget.
Why it hurts
Months later, nobody knows what a subscription is for, and it keeps billing without anyone responsible.
Better approach
Require a name pattern, a named owner, a budget, and a management group for every new subscription.
“A subscription is just a billing account.” Not true. It is also an access boundary, a quota boundary, and a policy scope, so treating it only as a bill can lead to messy designs.
14Best Practices Checklist
A short list to follow when setting up or reviewing subscriptions.
Plan the hierarchy first
Design management groups and a naming scheme before creating many subscriptions.
Name and tag consistently
Include purpose and environment in names, and require owner and cost-center tags through policy.
Separate production
Keep live systems in their own subscriptions with stricter access and policies.
Use groups for access
Assign roles to groups, review them regularly, and remove old assignments.
Apply policy high in the tree
Place broad rules on management groups so every subscription inherits them.
Set budgets and alerts early
Create a budget for each subscription on day one, with notifications to a real person.
Centralize logs
Send activity logs to a shared workspace and alert on risky events.
Automate creation
Use templates and subscription vending so every new subscription starts the same, safe way.
Review regularly
Every few months, look for unused subscriptions, unknown owners, and unexpected costs, and clean them up.
15Troubleshooting Common Subscription Problems
Most beginner trouble has simple causes.
| Problem | Likely cause | What to try |
|---|---|---|
| I cannot see my subscription | Wrong directory, a filter on the subscription list, or no role assigned | Switch directory, clear filters, and ask an Owner for access |
| Create fails with a provider not registered message | The resource provider is not registered in this subscription | Register the provider, using an account that has the right role |
| Quota exceeded message | Regional limit for that size or service reached | Request a quota increase, or choose another size or region |
| Subscription disabled | Unpaid bill, expired credit, or cancellation | Fix payment or upgrade the offer, then reactivate if still allowed |
| Action blocked by a policy | A company rule at a higher level forbids it | Read the policy name in the error and follow the allowed option or request an exception |
| Cannot delete a resource | A lock is in place or other items depend on it | Check locks and dependencies |
| Costs surprise the team | Forgotten resources or no budget | Use cost analysis by resource group and tag, delete leftovers, and add budgets |
16Real-World Stories
How different people use subscriptions.
The student
A learner opens a free or student subscription, builds a small web app and a database, watches the credit balance, and deletes the resources when finished. One subscription is enough, and the main lesson is cost awareness.
The small software team
A five-person team uses one pay-as-you-go subscription for production and a separate one for development and testing. The split keeps experiments away from live customers and makes it easy to see test costs.
The growing company
As teams multiply, the company creates management groups for platform, production, and non-production. A central team owns shared networking in one subscription, and each application team gets its own. Policies at the top require approved regions and mandatory tags.
The large enterprise
A global organization with hundreds of applications uses automated subscription vending, a landing zone design, and central logging. New teams receive a ready, governed subscription within hours instead of weeks.
17Frequently Asked Questions
18Summary and Key Takeaways
Key Takeaways
- A subscription is a container and a boundary. It holds resources and defines the limits of billing, access, and quotas.
- Know the tree. A tenant holds identities, management groups organize subscriptions, subscriptions hold resource groups, and resource groups hold resources.
- Offers decide how you pay. Free, pay-as-you-go, enterprise, customer agreement, partner, and sponsored subscriptions differ in pricing and invoicing, so read current terms.
- Every creation request passes subscription checks. Identity, role, policy, provider registration, and quota are all verified before real work starts.
- Design with purpose. Separate production, teams, sensitive data, and large workloads into their own subscriptions, and organize them with management groups and landing zones.
- Govern, protect, and watch. Apply policy high in the tree, use least privilege and multi-factor sign-in, set budgets and alerts, centralize logs, and review regularly.