Azure Subscriptions, Tenants and Resource Groups Explained

Azure's structure confuses newcomers because the word "account" maps to at least three different things depending on who is speaking. Untangling that is the first step to understanding what you actually control.

Tenant, subscription, resource group

A tenant is a Microsoft Entra ID directory. It holds users, groups, service principals and app registrations. It is the identity boundary.

A subscription is the billing and quota boundary. It has an offer type, a billing owner, spending limits and its own per-region quotas. A subscription trusts exactly one tenant at a time for authentication — but it can be transferred to a different tenant, which is a genuinely unusual property among cloud platforms.

A resource group is a logical container inside a subscription. Everything you deploy lives in one. Resource groups have a location of their own, which stores the group's metadata, independent of where the resources inside them run.

Management groups sit above subscriptions for policy inheritance in larger estates.

Because a subscription can move between tenants, "who controls the directory" and "who controls the subscription" are two separate questions. A complete hand-over answers both.

Two permission systems, not one

This is the detail that causes the most trouble. Azure runs two parallel permission models:

A Global Administrator in the directory does not automatically have access to resources. An Owner on a subscription does not automatically control the directory. Auditing one and not the other leaves half the access in place.

Alongside both sit service principals and app registrations — non-human identities with client secrets or certificates. These survive user password changes entirely and are the Azure equivalent of a forgotten access key.

Offer types matter more than the portal suggests

The subscription's offer type determines what it can do:

• Free trial — carries a starting credit, applies spending caps, and converts or expires on a fixed date. Some resource types are unavailable.
• Pay-as-you-go — a standard commercial relationship, quotas requestable, no artificial ceiling.
• Enterprise or CSP agreements — governed by an enrolment or a partner relationship, with its own administrative layer.

A trial subscription with credit and a pay-as-you-go subscription with the same credit are not equivalent, because the trial's spending cap will stop deployments rather than bill you. For anything you intend to keep running, pay-as-you-go is the state to look for. The configurations listed on the Azure account page distinguish between these explicitly, which is the distinction worth reading first.

Quotas, regions and VM families

Azure quota is per subscription, per region, per VM family. The families follow a letter convention:

• B-series — burstable, credit-based, for intermittent load.
• D-series — general purpose, the usual default.
• E-series — memory-optimised.
• F-series — compute-optimised.
• L-series — storage-optimised with local NVMe.
• N-series — GPU-attached.

Regional availability is genuinely uneven. A VM family available in West Europe may not be offered in a smaller region, and quota in one region tells you nothing about another. Confirm the family, the region and the quota number together.

Managed disk tier is the companion decision: Standard HDD for archival, Standard SSD for light workloads, Premium SSD for production databases, and Ultra Disk where you need to tune IOPS and throughput independently of capacity.

Where Azure earns its place

Azure's strongest argument is integration with an existing Microsoft estate. If identity already lives in Entra ID, if licensing is already negotiated, or if the application stack is .NET and SQL Server, the operational path is shorter than on any other platform. Azure Hybrid Benefit can make Windows Server and SQL Server workloads materially cheaper than the equivalent elsewhere.

It is also a serious option for regulated workloads, with a wide compliance portfolio and sovereign region options in several jurisdictions.

Where it is less compelling is the small, single-server case. The conceptual overhead of tenants, subscriptions and two permission systems is real, and for one application server a Linode account or UpCloud account gets you to a running machine faster. The Google Cloud and Azure comparison goes deeper on where each one pulls ahead.

A realistic post-transfer sequence

1. Confirm which tenant the subscription trusts, and whether it should be moved.
2. Reset credentials for the account holder and re-enrol MFA.
3. Audit Entra ID roles — especially Global Administrator.
4. Audit Azure RBAC assignments at subscription and resource group level.
5. List every service principal and app registration; review secrets and certificates and their expiry dates.
6. Confirm the billing owner on the subscription is you.
7. Set a budget with action groups before deploying.
8. Check Azure Policy assignments inherited from any management group.

Frequently asked questions

Can a subscription be moved to a different tenant? Yes. This is a supported operation, but RBAC assignments do not follow — they must be rebuilt afterwards, which is the step people forget.

Does deleting a user remove its app registrations? No. App registrations are directory objects in their own right and persist independently.

Is a spending limit the same as a budget? No. A spending limit on a trial subscription stops deployments outright. A budget is an alerting mechanism that does not stop anything by itself.

What happens to credits on conversion to pay-as-you-go? Remaining trial credit generally does not carry over. Confirm the specific offer terms rather than assuming.

The Buy Azure Account listing sets out which configurations are currently available, including the offer type and any credit attached.