📚 AZ-104 Series: This is Part 5 of 67 in the complete Azure Administrator (AZ-104) study guide.

Introduction

Azure Subscriptions and Management Groups are fundamental concepts in Azure that help you manage and organize your resources effectively. As a beginner, understanding these concepts is crucial for the AZ-104 exam and for deploying and managing resources in Azure. In this blog post, we will delve into the world of Azure Subscriptions and Management Groups, exploring what they are, why they matter, and how to use them. By the end of this post, you will have a solid understanding of how to create and manage Azure Subscriptions and Management Groups, and how to use them to streamline your Azure resource management.

Think of Azure Subscriptions as a container that holds all your Azure resources, such as virtual machines, storage accounts, and databases. Just like how you organize your files and folders on your computer, Azure Subscriptions help you organize your Azure resources in a logical and structured way. Management Groups, on the other hand, are like folders that hold multiple Azure Subscriptions, allowing you to apply policies and access control at a higher level. Understanding how to use these concepts is essential for any Azure administrator, and is a key part of the AZ-104 exam.

In this blog post, we will cover the core concepts of Azure Subscriptions and Management Groups, including hierarchy, billing, governance, and access control. We will also provide a step-by-step guide on how to create and manage Azure Subscriptions and Management Groups using the Azure Portal and Azure CLI. By the end of this post, you will be able to create and manage your own Azure Subscriptions and Management Groups, and apply policies and access control to your Azure resources.

Core Concepts

Let’s start with the core concepts of Azure Subscriptions and Management Groups. An Azure Subscription is a container that holds all your Azure resources, such as virtual machines, storage accounts, and databases. It’s like a big bucket that holds all your Azure stuff. Each Azure Subscription has its own billing and cost tracking, so you can see how much you’re spending on each resource. Azure Subscriptions also have their own access control and security settings, so you can control who can access and manage your resources.

A Management Group, on the other hand, is a container that holds multiple Azure Subscriptions. It’s like a folder that holds multiple buckets. Management Groups allow you to apply policies and access control at a higher level, so you can manage multiple Azure Subscriptions at once. This is useful for large organizations that have multiple Azure Subscriptions and need to apply consistent policies and access control across all of them.

The hierarchy of Azure Subscriptions and Management Groups is like a tree structure. At the top of the tree is the root Management Group, which is the highest level of management. Under the root Management Group are multiple Management Groups, each of which can hold multiple Azure Subscriptions. This allows you to create a hierarchical structure that reflects your organization’s needs and structure.

Billing and cost tracking are also important concepts in Azure Subscriptions and Management Groups. Each Azure Subscription has its own billing and cost tracking, so you can see how much you’re spending on each resource. You can also use Azure Cost Estimator to estimate the costs of your Azure resources and optimize your spending.

How It Works

So, how do Azure Subscriptions and Management Groups work? Let’s take a look at the architecture and components. At the top of the hierarchy is the root Management Group, which is the highest level of management. Under the root Management Group are multiple Management Groups, each of which can hold multiple Azure Subscriptions. Each Azure Subscription, in turn, holds multiple Azure resources, such as virtual machines, storage accounts, and databases.

When you create an Azure Subscription, you specify the billing and cost tracking settings, as well as the access control and security settings. You can also specify the policies and access control settings for the Azure Subscription, such as who can manage the resources and what actions they can perform.

When you create a Management Group, you can specify the policies and access control settings for the Management Group, such as who can manage the Azure Subscriptions and what actions they can perform. You can also apply policies and access control settings to multiple Azure Subscriptions at once, which makes it easier to manage large numbers of Azure resources.

The architecture of Azure Subscriptions and Management Groups is designed to be flexible and scalable, so you can create a hierarchical structure that reflects your organization’s needs and structure. You can also use Azure CLI and Azure Portal to create and manage Azure Subscriptions and Management Groups, which makes it easy to automate and script your Azure resource management tasks.

Step-by-Step Guide: Azure Portal

Now that we’ve covered the core concepts and architecture of Azure Subscriptions and Management Groups, let’s take a look at how to create and manage them using the Azure Portal. Here are the steps:

1. Log in to the Azure Portal and click on the “Subscriptions” tab.
2. Click on the “New Subscription” button and fill in the required information, such as the subscription name and billing information.
3. Click on the “Create” button to create the new Azure Subscription.
4. To create a new Management Group, click on the “Management Groups” tab and click on the “New Management Group” button.
5. Fill in the required information, such as the Management Group name and description.
6. Click on the “Create” button to create the new Management Group.
7. To add an Azure Subscription to a Management Group, click on the “Subscriptions” tab and select the Azure Subscription you want to add.
8. Click on the “Move” button and select the Management Group you want to move the Azure Subscription to.
9. Click on the “Move” button to move the Azure Subscription to the selected Management Group.

That’s it! You’ve now created and managed Azure Subscriptions and Management Groups using the Azure Portal.

Azure CLI Commands


# Create a new Azure Subscription
az account create --name "My Subscription" --offer-type "MS-AZR-0148P"

# Create a new Management Group
az account management-group create --name "My Management Group" --display-name "My Management Group"

# Add an Azure Subscription to a Management Group
az account management-group subscription add --name "My Management Group" --subscription-id "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

# List all Azure Subscriptions
az account list

# List all Management Groups
az account management-group list


These are just a few examples of the Azure CLI commands you can use to create and manage Azure Subscriptions and Management Groups. You can use the Azure CLI to automate and script your Azure resource management tasks, which makes it easier to manage large numbers of Azure resources.

Real-World Use Cases

Azure Subscriptions and Management Groups are essential components in Azure, and understanding their real-world use cases is crucial for effective management and optimization. Here are three detailed practical scenarios with examples:

In a large organization, you can use Management Groups to organize Azure subscriptions by department, such as finance, marketing, and IT. For instance, you can create a Management Group for the finance department and assign the finance team’s Azure subscription to it. This allows you to apply policies and access controls at the Management Group level, ensuring that the finance team’s resources are secure and compliant with organizational policies.

Another scenario is using Azure Subscriptions to manage different environments, such as development, testing, and production. You can create separate Azure subscriptions for each environment and use Management Groups to organize them. For example, you can create a Management Group for development environments and assign the development team’s Azure subscription to it. This allows you to apply policies and access controls specific to the development environment, such as allowing developers to create and manage resources without affecting production environments.

A third scenario is using Azure Subscriptions and Management Groups to manage resources for different regions or countries. For instance, a multinational company can create separate Azure subscriptions for each region and use Management Groups to organize them. This allows you to apply policies and access controls specific to each region, such as complying with local regulations and laws.

• Create a Management Group for each department or team to organize Azure subscriptions and apply policies and access controls.
• Use Azure Subscriptions to manage different environments, such as development, testing, and production.
• Use Management Groups to organize Azure subscriptions by region or country to comply with local regulations and laws.

Best Practices

Following best practices is essential to ensure effective management and optimization of Azure Subscriptions and Management Groups. Here are at least eight best practices with explanations:

1. Organize Azure subscriptions by department or team: This allows you to apply policies and access controls specific to each department or team, ensuring that resources are secure and compliant with organizational policies.

2. Use Management Groups to organize Azure subscriptions: Management Groups provide a hierarchical structure to organize Azure subscriptions, making it easier to manage and apply policies and access controls.

3. Use Azure Subscriptions to manage different environments: Separate Azure subscriptions for development, testing, and production environments ensure that resources are isolated and secure.

4. Apply policies and access controls at the Management Group level: This ensures that policies and access controls are applied consistently across all Azure subscriptions within a Management Group.

5. Monitor and analyze Azure subscription costs: Regularly monitoring and analyzing costs helps identify areas for optimization and ensures that resources are used efficiently.

6. Use Azure Cost Estimator to estimate costs: The Azure Cost Estimator tool helps estimate costs for Azure resources, ensuring that you plan and budget effectively.

7. Use Azure Advisor to optimize resources: Azure Advisor provides recommendations to optimize Azure resources, ensuring that you use resources efficiently and effectively.

8. Regularly review and update Azure subscriptions and Management Groups: Regular reviews ensure that Azure subscriptions and Management Groups are up-to-date and aligned with organizational policies and goals.

• Organize Azure subscriptions by department or team.
• Use Management Groups to organize Azure subscriptions.
• Use Azure Subscriptions to manage different environments.
• Apply policies and access controls at the Management Group level.
• Monitor and analyze Azure subscription costs.
• Use Azure Cost Estimator to estimate costs.
• Use Azure Advisor to optimize resources.
• Regularly review and update Azure subscriptions and Management Groups.

Common Mistakes to Avoid

Avoiding common mistakes is essential to ensure effective management and optimization of Azure Subscriptions and Management Groups. Here are at least five mistakes with explanations of how to fix them:

1. Not organizing Azure subscriptions by department or team: Failing to organize Azure subscriptions by department or team can lead to confusion and inconsistencies in policy and access control application. To fix this, create a Management Group for each department or team and assign the corresponding Azure subscription to it.

2. Not using Management Groups to organize Azure subscriptions: Not using Management Groups can lead to a flat structure, making it difficult to manage and apply policies and access controls. To fix this, create a hierarchical structure using Management Groups to organize Azure subscriptions.

3. Not using Azure Subscriptions to manage different environments: Not using separate Azure subscriptions for development, testing, and production environments can lead to resource conflicts and security issues. To fix this, create separate Azure subscriptions for each environment and use Management Groups to organize them.

4. Not applying policies and access controls at the Management Group level: Not applying policies and access controls at the Management Group level can lead to inconsistencies in policy and access control application. To fix this, apply policies and access controls at the Management Group level to ensure consistency across all Azure subscriptions within the group.

5. Not monitoring and analyzing Azure subscription costs: Not monitoring and analyzing costs can lead to unexpected expenses and inefficient resource use. To fix this, regularly monitor and analyze costs using Azure Cost Estimator and Azure Advisor to identify areas for optimization.

• Not organizing Azure subscriptions by department or team.
• Not using Management Groups to organize Azure subscriptions.
• Not using Azure Subscriptions to manage different environments.
• Not applying policies and access controls at the Management Group level.
• Not monitoring and analyzing Azure subscription costs.

AZ-104 Exam Tips

To succeed in the AZ-104 exam, it’s essential to focus on key areas and be aware of typical exam question styles and gotchas. Here are some key points to memorize:

Key concepts: Understand the concepts of Azure Subscriptions, Management Groups, and policy and access control application.

Typical exam question styles: Expect scenario-based questions that require you to apply your knowledge to real-world situations.

Gotchas: Be aware of common mistakes, such as not organizing Azure subscriptions by department or team, and not using Management Groups to organize Azure subscriptions.

To prepare for the exam, focus on the following areas:

• Azure Subscriptions and Management Groups.
• Policy and access control application.
• Azure Cost Estimator and Azure Advisor.
• Scenario-based questions.

  Key concepts:
  - Azure Subscriptions
  - Management Groups
  - Policy and access control application
  Typical exam question styles:
  - Scenario-based questions
  Gotchas:
  - Not organizing Azure subscriptions by department or team
  - Not using Management Groups to organize Azure subscriptions

Summary and Next Steps

In this blog post, we covered Azure Subscriptions and Management Groups, including real-world use cases, best practices, common mistakes to avoid, and AZ-104 exam tips.

To recap, Azure Subscriptions and Management Groups are essential components in Azure, and understanding their use cases, best practices, and common mistakes is crucial for effective management and optimization.

Next steps:

• Study Azure policy and access control application.
• Learn about Azure Cost Estimator and Azure Advisor.
• Practice scenario-based questions.
• Review and update your knowledge of Azure Subscriptions and Management Groups.

Stay tuned for the next blog post in the series, where we’ll cover Azure policy and access control application in more detail.

  Next steps:
  - Study Azure policy and access control application
  - Learn about Azure Cost Estimator and Azure Advisor
  - Practice scenario-based questions
  - Review and update your knowledge of Azure Subscriptions and Management Groups