Quick Note — Recommend a Structure for Management Groups, Subscriptions, Resource Groups, and Tagging
AZ-305 › Unit 1 › Design governance › Recommend a structure for management groups, subscriptions, and resource groups, and a strategy for resource tagging
Quick Note — Recommend a Structure for Management Groups, Subscriptions, Resource Groups, and Tagging
Azure gives architects a four-level resource hierarchy — Management Groups, Subscriptions, Resource Groups, and Resources — along with a free-form tag system that acts as a cross-cutting dimension for cost, ownership, and compliance. This lesson teaches you how to design those levels deliberately so that governance, security, and FinOps requirements propagate top-down without manual effort per subscription. The Azure Cloud Adoption Framework (CAF) and the Azure Landing Zone reference architecture are the canonical sources we align to throughout.
Retrieval target
- Recommend a Structure for Management Groups, Subscriptions, Resource Groups, and Tagging
- Closed-book recall
- 5 minutes
- Open the full lesson after a miss
Decision anchors
| Prompt | Compact answer |
|---|---|
Management group | A container that groups subscriptions for unified access (RBAC) and governance (Policy) management. Governance applied at a management group inherits down to every subscription inside it. Up to per tenant, max 6 levels deep (excluding root and subscription levels). Each management group has exactly one parent. |
Subscription (ARM) | A unit of billing, scale, and management. Azure resource limits (e.g., 250 storage accounts) and many quotas are scoped to a subscription. A subscription is also an RBAC + Policy scope; assignments at the subscription cascade to its resource groups and resources. Each subscription has exactly one parent management group. |
Resource group | A logical container for Azure resources within one subscription that share a lifecycle — created, deployed, monitored, and deleted together. Also a scope for RBAC, Policy, and tags. Resources can move between resource groups (with caveats per resource type), but a resource lives in exactly one RG at a time. |
Tag (Azure resource tag) | A name/value string pair attached to a resource, RG, or subscription used for filtering, cost analysis, automation, and policy targeting. Up to 50 tags per resource; values are case-insensitive but key spelling matters (Env=prod ≠ env=prod). Establish a tag taxonomy early — retrofitting tags is costly. |
Read the answers once, then cover the right-hand column and reconstruct each one from the prompt. A useful answer names the requirement, the recommended control or service boundary, and the nearest alternative it rejects. If you can only recognize the answer after seeing it, retrieval is not yet secure.
Ninety-second explanation
Without notes, explain:
- What requirement signals this learning objective rather than a neighbouring one?
- Which two solution families are most likely to be compared?
- Which hard constraint eliminates the strongest distractor?
- What identity, network, data, or failure boundary must appear in the design?
- Which operational test would prove the recommendation works?
Then compare your explanation with the full lesson. Record the missing decision rule—not merely the missed product name—in your error log.
When to open the full lesson
Open the curriculum-linked lesson when you cannot explain a comparison, when a scenario depends on a numeric limit or SKU feature, or when the service is on a retirement path. Use current Microsoft Learn documentation for availability, limits, pricing, naming, and migration milestones; the quick note is intentionally compact.
Source and freshness
Derived from the linked AZ-305 lesson and retrieval deck, grounded in both attached course sources. Reviewed 2026-08-02. Current Microsoft documentation controls changing product contracts.