Curriculum Overview: Azure Subscriptions and Management Hierarchy

This curriculum provides a comprehensive deep dive into the organizational structures of Microsoft Azure, focusing on how subscriptions act as the fundamental unit of billing and resource management. Students will learn how to structure Azure environments for scale, security, and cost-efficiency.

Prerequisites

Before starting this module, students should have a baseline understanding of the following:

Cloud Fundamentals: Completion of AZ-900 Unit 1 (Cloud Concepts), including IaaS, PaaS, and SaaS models.
Azure Accounts: Understanding that an Azure Account is the top-level identity that can host one or more subscriptions.
Resource Basics: Familiarity with the idea that Azure "resources" are instances of services (like VMs or SQL Databases).

Module Breakdown

Module	Topic	Difficulty	Focus Area
1	The Azure Subscription	Beginner	IDs, Naming, and Billing Boundaries
2	Management Groups	Intermediate	Enterprise-scale organization and Policy
3	The Azure Hierarchy	Intermediate	Nesting resources, groups, and subscriptions
4	Governance & Limits	Advanced	Subscription limits and hierarchical constraints

Learning Objectives per Module

Module 1: The Azure Subscription

Define the Subscription ID as the globally unique identifier for Azure resources.
Explain the role of a subscription as a billing boundary and an access control boundary.
Identify scenarios for creating multiple subscriptions (e.g., separating Dev/Test and Production costs).

Module 2: Management Groups

Describe the purpose of Management Groups as containers for subscriptions.
Explain how policies and access controls applied at the Management Group level inherit downward.

Module 3: The Azure Hierarchy

Visualize the four-level hierarchy: Management Groups → Subscriptions → Resource Groups → Resources.
Define the Tenant Root Group as the default top-level management group.

Loading Diagram...

Success Metrics

To demonstrate mastery of this curriculum, the learner must be able to:

Map the Hierarchy: Diagram the relationship between a Tenant Root Group and a specific resource without errors.
Identify Constraints: State the maximum depth of a management group hierarchy (6 levels) and the total limit (10,000 groups).
Audit Billing: Explain where to find subscription invoices within the Azure Portal and how to identify a subscription using its ID.
Policy Application: Explain why applying a policy to a Management Group is more efficient than applying it to ten individual subscriptions.

Real-World Application

In a professional environment, understanding subscriptions is critical for Cloud Governance and FinOps (Financial Operations):

[!IMPORTANT] Subscriptions are often used to separate departmental costs. For example, the Marketing department and the Engineering department might each have their own subscription so that their cloud spend can be invoiced separately.

Visualizing the Billing Boundary

Below is a conceptual diagram of how a subscription wraps around resource groups to create a distinct management and billing unit.

\begin{tikzpicture} % Draw the Subscription Box \draw[thick, dashed, fill=blue!5] (0,0) rectangle (6,4); \node at (3,4.3) {\textbf{Azure Subscription}}; \node at (3,3.7) {\small (Billing Boundary)};

code

% Resource Group 1
\draw[thick, fill=orange!10] (0.5,0.5) rectangle (2.5,2.5);
\node at (1.5,2.2) {\footnotesize RG: Production};
\draw[fill=gray!30] (1,1) circle (0.3) node{\tiny VM};
\draw[fill=gray!30] (2,1) circle (0.3) node{\tiny DB};

% Resource Group 2
\draw[thick, fill=green!10] (3.5,0.5) rectangle (5.5,2.5);
\node at (4.5,2.2) {\footnotesize RG: Testing};
\draw[fill=gray!30] (4,1) circle (0.3) node{\tiny VM};
\draw[fill=gray!30] (5,1) circle (0.3) node{\tiny App};

\end{tikzpicture}

Recommended Resources

Azure Portal: Navigate to the "Subscriptions" blade to view current IDs and Invoices.
Microsoft Entra ID: Review the connection between the Tenant Root Group and your identity directory.
Azure Documentation: Study the "Azure subscription limits and quotas" to understand resource scaling boundaries.