Techie BabajiLearn to Code. Build Real Skills.
Microsoft Azure · Cloud Basics

Subscriptions and Resource Groups

Azure organises everything in a hierarchy. Getting it right early keeps permissions, billing and clean-up simple.

Beginner 5 min Lesson 4 of 28
Before you start:Azure Fundamentals
0/28 in Microsoft Azure
On this page · 5 min · Beginner

On this page

  1. Learning objectives
  2. Explanation
  3. Code example
  4. Step by step
  5. Real-world use
  6. Common mistakes
  7. Best practices
  8. Remember this
  9. Practice exercise
  10. Mini quiz
  11. Related topics
  12. My notes
Reading time
5 min
Difficulty
Beginner
Updated
Oct 29, 2026

Related tutorials

Interview questions

Learning objectives#

  • Explain management groups, subscriptions and resource groups
  • Group resources by lifecycle
  • Apply tags for cost tracking
  • Assign access at the right scope

Explanation#

The hierarchy is: management groups → subscriptions → resource groups → resources. Settings and permissions applied higher up are inherited below.

A subscription is a billing and access boundary. Many companies use separate subscriptions for production and development.

A resource group holds resources that share a lifecycle — created, updated and deleted together, such as a web app, its database and its storage.

Tags are key–value labels (environment=prod, owner=asha) used for cost reports and automation.

Code example: A tagged resource group with scoped access#

ShellA tagged resource group with scoped access Illustrative
az group create --name rg-shop-dev --location centralindia \
  --tags environment=dev owner=asha project=shop


# Give a teammate Contributor rights on this group only
az role assignment create --assignee ravi@example.com \
  --role Contributor \
  --scope /subscriptions/<subscription-id>/resourceGroups/rg-shop-dev


az group list --tag project=shop --output table
Expected output
Name         Location      Status
-----------  ------------  ---------
rg-shop-dev  centralindia  Succeeded

This example is illustrative. Copy or download it and run it in your own environment; the expected output is shown above.

Step-by-step explanation#

  1. The resource group gets three tags for reporting.
  2. The role assignment is scoped to one resource group, not the whole subscription.
  3. Filtering by tag lists every group belonging to the project.

Real-world use case#

A team keeps rg-shop-dev, rg-shop-test and rg-shop-prod. Developers have Contributor on dev and test, but only Reader on prod.

Common mistakes#

One giant resource group

Mixing unrelated apps makes permissions and clean-up risky. Group by application and lifecycle.

Owner access for everyone

Owner can grant access to others. Give the least privilege that does the job.

Best practices#

  • Separate production and non-production subscriptions
  • Use a consistent naming convention (rg-app-env)
  • Enforce required tags with Azure Policy
  • Assign roles to groups, not individuals

Remember this#

Management group → Subscription → Resource group → Resource.

Resource group = things that live and die together.

Tags make the bill readable.

Practice exercise#

Your task: Create rg-blog-prod with tags environment=prod and owner=you, then list its tags.

Show solution
Shell Illustrative
az group create -n rg-blog-prod -l centralindia --tags environment=prod owner=you
az group show -n rg-blog-prod --query tags

Mini quiz#

Subscriptions and Resource Groups quizMultiple choice Question 1 of 1

What is the main billing boundary in Azure?

Score so far: 0/0

Want more? Practise all Microsoft Azure MCQs · Microsoft Azure interview questions

My notes#

Saved in this browser.

Progress is saved in this browser. Sign in to sync.