Describe Azure architecture and services
Azure Resource Hierarchy
CorePlace resources, resource groups, subscriptions, and management groups in the correct scope.
Aligned to the AZ-900 skills measured as of July 20, 2026; product behavior verified August 23, 2026.
Why this matters
Governance, access, billing, and lifecycle questions often use the same nouns. Naming the hierarchy level prevents applying a control at the wrong conceptual boundary.
Must Know
- A resource is a manageable Azure item such as a virtual machine, virtual network, or storage account.
- A resource group is a logical container for resources commonly managed through a shared lifecycle. A resource belongs to one resource group at a time.
- A subscription is an Azure resource, access, and billing boundary that contains resource groups.
- A management group organizes subscriptions so governance and access assignments can apply above them.
- The hierarchy is management group → subscription → resource group → resource. Assignments at a parent scope can apply to descendants.
Compare and Distinguish
- Resource group vs tag: a management container versus key-value metadata used for organization and reporting.
- Resource group vs subscription: lifecycle organization inside a subscription versus a broader billing and access boundary.
- Subscription vs management group: resource/billing boundary versus governance organization above multiple subscriptions.
- Hierarchy vs geography: regions and zones describe placement, not Azure management hierarchy levels.
Scenario examples
- Two business units receive separate subscriptions for distinct billing and access boundaries, each with several resource groups.
- Resources for one application lifecycle are placed in a resource group.
- An enterprise organizes several subscriptions under a management group for common governance.
Exam traps
- Tags are not hierarchy levels and do not become resource groups.
- A management group contains subscriptions, not resources directly in place of resource groups.
- A resource group is not a billing boundary equivalent to a subscription.
Key takeaways
- Trace scope from management group to resource.
- Use resource groups for logical lifecycle management and subscriptions for access/billing boundaries.
- Use management groups when governance must span subscriptions.
Ready for the quiz?
- Which level directly contains resource groups?
- When is a management group appropriate?
- Why can a tag not replace a resource group?
Related objectives
- D2.1.S4 — Describe Azure resources and resource groups
- D2.1.S5 — Describe subscriptions
- D2.1.S6 — Describe management groups
- D2.1.S7 — Describe the hierarchy of resource groups, subscriptions, and management groups