Azure Setup: Subscriptions, Groups & Users Key Facts

Setting up Microsoft Azure correctly starts with understanding three core identity and management concepts: Azure subscriptions, management groups, and users (and the groups that contain them). In short, a user signs in to an Azure Active Directory (now Microsoft Entra ID) tenant, that user is placed in groups for permission assignment, and the tenant is organized into management groups and subscriptions that control billing and resource isolation. This article explains how these pieces fit together, how to structure them, and the common pitfalls to avoid.

Formula

The calculator above computes your average running pace and speed. The formula for pace is:

Pace (min/km) = Total Time (minutes) / Distance (km)

Speed (km/h) = Distance (km) / (Total Time (minutes) / 60)

Where:

• Total Time is the duration of your run in minutes.
• Distance is the length of your run in kilometers.

Worked Example

Using the default values: you run 10 km in 60 minutes.

Pace = 60 / 10 = 6.00 min/km

Speed = 10 / (60 / 60) = 10.00 km/h

The calculator displays 6.00 min/km as your average pace and 10.00 km/h as your average speed.

Background: The Azure Hierarchy

Azure organizes resources in a clear hierarchy. At the top is your Microsoft Entra ID tenant (formerly Azure Active Directory). This tenant is a dedicated, isolated instance of the identity service. Everything else lives under it. Below the tenant, you have management groups, which can contain subscriptions, and subscriptions contain resource groups, which contain resources like virtual machines and databases.

Users are identities in the tenant. Groups are collections of users. You assign roles (permissions) to users or groups at any scope: management group, subscription, resource group, or resource. This structure lets you apply policies and access controls consistently across your entire environment.

How It Works: Subscriptions, Groups, and Users

Let’s break down each component:

• Users: Each person who needs access to Azure has a user account in the tenant. This can be a cloud-only account or a synchronized account from on-premises Active Directory using Microsoft Entra Connect.
• Groups: Groups are used to assign permissions to multiple users at once. Microsoft Entra ID supports security groups and Microsoft 365 groups. You can assign a role like “Virtual Machine Contributor” to a group, and all members inherit that permission.
• Subscriptions: A subscription is a billing and isolation boundary. It links to a payment method and has its own set of quotas and limits. Resources are created within a subscription, and you can have multiple subscriptions for different environments (dev, test, prod) or departments.
• Management Groups: These sit above subscriptions and allow you to apply policies and access controls to multiple subscriptions at once. For example, you can create a management group for “Production” and another for “Non-Production” and apply different policies to each.

When you assign a role, you choose a scope. The scope can be a management group, subscription, resource group, or a specific resource. Permissions are inherited down the hierarchy. For example, if you assign the “Reader” role to a user at the subscription level, they can read all resource groups and resources in that subscription.

How to Choose the Right Structure

Choosing the right structure depends on your organization’s size and governance needs. Here are some guidelines:

• Start with a single tenant. Unless you have a specific requirement for separation (e.g., government compliance), one tenant is easier to manage.
• Use management groups for environments. Create management groups for Production, Development, and Test. Apply policies like “Allowed Locations” or “Deny Public IP Address” at these levels.
• Use subscriptions for cost centers. If you need separate billing, create subscriptions per department or project. This makes it easier to track costs.
• Use resource groups for lifecycle. Put resources that are created and destroyed together in the same resource group. For example, a web app and its database might share a resource group.
• Assign roles to groups, not individuals. This simplifies management. When someone joins or leaves a project, you just add or remove them from a group.

Common Problems and Misconceptions

One common misconception is that a subscription is the same as an account. In reality, a subscription is a billing container. You can have multiple subscriptions under one account. Another issue is creating too many subscriptions without a clear structure, leading to policy sprawl and difficulty in managing access.

Another frequent problem is assigning roles at the resource level instead of the resource group level. This creates a mess when you have many resources. It’s better to assign at a higher scope and let permissions inherit.

Also, be careful with the “Global Administrator” role in Microsoft Entra ID. It has full control over the tenant, including billing. Limit the number of users with this role.

Costs and Billing

Subscriptions are tied to a billing account. You can set up spending limits and alerts. However, you cannot have a subscription without a payment method. For enterprise agreements, the billing is handled through a separate portal. The key point is that each subscription has its own cost management view, which helps in tracking expenses.

There are also free and trial subscriptions, but they have limited quotas. Always check the service limits for your subscription type.

Safety and Access Control

Security in Azure relies on least privilege. Always assign the minimum permissions needed. Use Azure Policy to enforce rules across your environment. For example, you can require that all storage accounts have encryption enabled.

Enable multi-factor authentication (MFA) for all users, especially those with administrative roles. Conditional Access policies can help control access based on location, device, and risk.

Regularly review access using Azure AD access reviews. This ensures that users who no longer need access are removed.

Alternatives and Comparisons

Azure’s main competitors are Amazon Web Services (AWS) and Google Cloud Platform (GCP). AWS uses a similar concept with accounts (instead of subscriptions) and Organizational Units (instead of management groups). GCP uses projects and folders. The concepts are similar: identity, resource containers, and policies.

One difference is that Azure has a tighter integration with Microsoft products like Office 365 and Windows Server, which can be an advantage in a Microsoft-centric environment.

Frequently Asked Questions

Can I move resources between subscriptions?

Yes, you can move resources between subscriptions, but there are limitations. Some resource types cannot be moved (e.g., Azure AD domain services). Also, the destination subscription must be in the same tenant. The move operation can take time and may cause downtime for some resources.

What is the difference between an Azure subscription and a management group?

A subscription is a billing and isolation boundary. A management group is a container that can hold multiple subscriptions. Management groups are used to apply policies and access controls at scale. Subscriptions are used for cost tracking and resource limits.

How many subscriptions can I have?

By default, you can have up to 50 subscriptions per tenant, but you can request an increase to 100. Each subscription has its own service limits (e.g., number of virtual machines).

What is a resource group?

A resource group is a logical container for resources that share the same lifecycle. You can deploy, update, and delete all resources in a resource group together. Resource groups are also a scope for role assignments.

Can I assign a role to a group in Azure?

Yes, you can assign roles to security groups in Microsoft Entra ID. This is a best practice because it simplifies permission management. When a user joins a group, they automatically get the permissions assigned to that group.

What is the difference between Azure AD and Microsoft Entra ID?

Microsoft Entra ID is the new name for Azure Active Directory. The service is the same, but the name changed in 2023. You may still see “Azure AD” in documentation, but it’s now referred to as Microsoft Entra ID.

Related

• AI Visual Assets for Marketing Teams: Five Formats
• AI Chatbot Data Privacy: What Gets Stored and Shared?
• World’s Fastest microSD Card: What “Fastest” Means

in t | Time (min) | min | 60 | 0
in d | Distance (km) | km | 10 | 0 | 100000
out pace | Average pace (min/km) | min/km | t / d | 2
out speed | Average speed (km/h) | km/h | d / (t / 60) | 2