Azure Resource Hierarchy

The Hierarchy Model

Azure organizes resources in a strict tree hierarchy: Management Groups at the root, Subscriptions below them, Resource Groups inside subscriptions, and individual Resources inside resource groups. Every level inherits policies and RBAC assignments from its parent.

Understanding this hierarchy is foundational. Everything you do in Azure — security, billing, compliance, governance — flows through this structure.

Management Groups

Management groups are containers that sit above subscriptions. They let you apply governance policies across multiple subscriptions at once. The root management group is the Tenant Root Group, which every subscription ultimately belongs to.

az account management-group list \
  --query "[].{id:id, name:name, displayName:displayName}" \
  --output table

Subscriptions

A subscription is a unit of billing, management, and governance. Every Azure resource must belong to a subscription. Subscriptions set spending limits, contain resource groups, and are where RBAC is initially scoped.

# List all subscriptions
az account list --query "[].{name:name, id:id, state:state}" --output table

# Set the active subscription
az account set --subscription "my-prod-subscription"

# Show current subscription
az account show --query "{name:name, id:id, tenantId:tenantId}" --output json

Resource Groups

A resource group is a logical container for Azure resources. All resources must live in a resource group, and resource groups can only exist within a subscription. Deleting a resource group deletes everything inside it.

# Create a resource group in East US
az group create --name rg-prod-webapp-eastus --location eastus

# List all resource groups
az group list --query "[].{name:name, location:location}" --output table

# Show resources in a group
az resource list --resource-group rg-prod-webapp-eastus --output table

# Delete a resource group and all its resources
az group delete --name rg-dev-playground --yes --no-wait

Naming Conventions

Microsoft publishes a set of naming conventions for Azure resources. Consistent naming makes resources identifiable by their name alone, which is critical when managing hundreds of resources across multiple subscriptions.

Tagging Strategy

Tags are key-value metadata pairs applied to resources and resource groups. They are the primary mechanism for cost allocation, automation triggers, and ownership tracking.

az group update \
  --name rg-payments-eastus \
  --set tags.Environment=production \
  --set tags.Team=payments \
  --set tags.CostCenter=CC-1234 \
  --set tags.ManagedBy=terraform

# Find all production resources
az resource list --tag Environment=production --query "[].{name:name, type:type}" --output table

# Find all resources managed by Terraform
az resource list --tag ManagedBy=terraform --query "[].{name:name, group:resourceGroup}" --output table