How Should Azure Administrators Organize Resources Using Resource Groups and Subscriptions?

One of the most important Azure architecture decisions happens before the first VM, App Service or database is deployed: How are subscriptions, resource groups, identities, policies and ownership going to be organized? A common beginner approach is: “Create one subscription and put everything inside it.” That may work initially, but enterprise environments need a more deliberate structure. A useful conceptual hierarchy is: Microsoft Entra ID / Tenant ↓ Management Groups ↓ Subscriptions ↓ Resource Groups ↓ Azure Resources The key is understanding that subscriptions and resource groups solve different problems. Subscriptions Subscriptions are useful for: Billing boundaries Environment or business-unit isolation Quota management Policy scope Access boundaries Operational ownership For example, an enterprise might separate: Production | Non-Production | Shared Services | Security rather than placing everything into one subscription. Resource Groups Resource groups are primarily useful for lifecycle and operational management. Resources that are normally deployed, monitored and retired together often belong in the same resource group. For example: rg-sales-prod-eastus could contain the application resources belonging to one workload. But don't blindly create a resource group for every individual resource. That often creates unnecessary operational complexity. The deeper architecture question The real question isn't: “How many resource groups should we create?” It's: “What are our management, ownership, security and lifecycle boundaries?” Then apply: Azure Policy RBAC Managed identities Tags Resource locks Defender for Cloud Azure Monitor Cost Management at the appropriate scopes. A strong Azure administrator thinks beyond deployment. They think about: Governance + Security + Cost + Operations + Scalability For example, if Finance needs cost visibility by business unit, your tagging and subscription strategy should support that from day one. Retrofitting governance after hundreds of resources have been deployed is much harder. If you're preparing for Azure Administrator roles or designing an enterprise Azure landing zone, these architectural decisions are exactly where practical experience matters. Connect with Softchief if you'd like to discuss Azure administration, architecture, governance or hands-on Microsoft training.