Why Governance Matters

As organizations scale in Azure, they often operate with multiple subscriptions across different departments, regions, or environments (Prod, Dev, Test). Without proper governance, this quickly becomes chaotic: inconsistent policies, poor cost tracking, and security risks.

Management Groups provide a way to structure and govern subscriptions at scale, while a subscription strategy ensures resources are logically separated and managed efficiently.

Management Groups

1. Definition

• Containers above subscriptions.

• Used to apply governance across multiple subscriptions.

2. Hierarchy

• Root Management Group (created automatically).

• Nested groups (up to 6 levels deep).

• Subscriptions assigned to management groups.

3. Policy & RBAC Inheritance

• Azure Policy and RBAC applied at management group level flow down to all child subscriptions and resource groups.

• Helps enforce consistent security/compliance rules.

Subscription Strategy

1. When to Use Multiple Subscriptions

• Environment separation: Prod vs Test vs Dev.

• Departmental control: Finance vs HR vs IT.

• Cost tracking: Easier to allocate budgets.

• Scale limits: Some services have subscription-level limits.

2. Best Practices

• Assign subscriptions to Management Groups (don’t leave “loose” subs).

• Use a clear naming convention (e.g., “Sub-Prod-Finance-EUS”).

• Align subscriptions with billing and cost management needs.

• Avoid too many subscriptions — balance manageability with separation.

Example Enterprise Scenario

A global retailer runs:

• One subscription for Production workloads.

• Another for Development/Testing.

• A third for Corporate IT systems.

They create a Management Group for “Retail Operations” and assign all three subscriptions under it. Policies such as “all storage accounts must use encryption” are applied at the management group level, ensuring compliance across all environments.

Confusion Buster

• Resource Group vs Management Group

  • Resource Group = contains actual resources (VMs, Storage, etc.).

  • Management Group = contains subscriptions.

• Subscription vs Tenant

  • Subscription = container for resources + billing.

  • Tenant = the identity boundary (Entra ID directory). One tenant can have multiple subscriptions.

Exam Tips

• “Apply encryption policies across all subscriptions” → Management Group.

• “Organize resources for billing and cost separation” → Subscription strategy.

• “Which container holds subscriptions?” → Management Group.

• “Which container holds resources?” → Resource Group.

What to Expect in the Exam

• Direct Q: “Which Azure container is used to group subscriptions?” → Management Group.

• Scenario Q: “Company requires a single policy applied to all subscriptions company-wide.” → Apply at Management Group level.

• Trick Q: “Resource groups can contain subscriptions.” → False.