How Azure is organised: tenants, subscriptions and resource groups

Why the structure matters

On your first day with Azure at a company, someone says "it is in the prod subscription, in rg-payments, in Central India". If you understand the structure, that sentence tells you who pays for it, who can touch it, and how to delete it safely. If you do not, Azure feels like a maze. So we start with the map before any services.

The hierarchy, top to bottom

A few rules about resource groups catch people out. Every resource belongs to exactly one resource group. Resource groups cannot be nested. A resource group has a location, which is where its metadata is stored, but the resources inside can be in other regions. Deleting a resource group deletes everything in it, which is very handy for labs and very dangerous in production. Protect important groups with a resource lock (CanNotDelete or ReadOnly).

Azure Resource Manager (ARM)

Azure Resource Manager is the single front door for creating and managing resources. The portal, the Azure CLI, PowerShell, Terraform and SDKs all send their requests to ARM, which checks your identity and permissions, applies Azure Policy, and then asks the right resource provider (such as Microsoft.Compute for VMs or Microsoft.Storage for storage) to do the work.

Because everything goes through ARM, you can describe resources in a template file and deploy it again and again. ARM templates are JSON. Bicep is a shorter, friendlier language that compiles to ARM JSON, and it is what Microsoft recommends for new templates. You will meet infrastructure as code properly in a later module.

param location string = resourceGroup().location

resource sa 'Microsoft.Storage/storageAccounts@2023-05-01' = {
  name: 'stdemo${uniqueString(resourceGroup().id)}'
  location: location
  sku: { name: 'Standard_LRS' }
  kind: 'StorageV2'
}

Regions, region pairs and availability zones

A region is a set of datacentres in one geographic area. Many regions have availability zones: separate datacentre groups inside the region with their own power, cooling and networking, so one zone can fail without taking down the others. Many regions are also paired with another region in the same geography; Azure uses pairs for things like geo-redundant storage and staggers platform updates between them.

India has three main public regions: Central India in Pune, South India in Chennai and West India in Mumbai. Central India and South India are a region pair, and Central India supports availability zones. Microsoft has announced more Indian regions, so check the current region list and which services each region offers. Data residency rules (for example for banks and government work) often decide the region for you.

Four ways to work with Azure

• Azure portal (portal.azure.com): the web console. Good for learning and for looking around.
• Azure CLI: the az command, on Windows, macOS and Linux. Good for scripts.
• Azure PowerShell: the Az module, with commands like New-AzResourceGroup. Popular with Windows administrators.
• Azure Cloud Shell: a browser terminal inside the portal with both az and PowerShell ready and already signed in.

az login                                   # opens the browser to sign in
az account show --output table             # which subscription am I using?
az account set --subscription "sub-payments-dev"
az group create --name rg-demo --location centralindia
az group list --output table
az group delete --name rg-demo --yes --no-wait   # deletes EVERYTHING inside

Connect-AzAccount
Get-AzContext
New-AzResourceGroup -Name rg-demo -Location centralindia
Get-AzResourceGroup | Format-Table ResourceGroupName, Location

Resource IDs

Every resource has a unique resource ID, a path that spells out where it lives: /subscriptions/{subscription-id}/resourceGroups/{group}/providers/{namespace}/{type}/{name}. For a VM that looks like /subscriptions/1111.../resourceGroups/rg-web/providers/Microsoft.Compute/virtualMachines/vm-web-01. You will paste these into role assignments, policies and scripts all the time.