Manage Azure Identities and Governance · Topic 4 of 4

Subscriptions, Management Groups and Costs

AZ-104 hierarchy and cost: resource groups, moving resources, subscriptions, management groups and their depth, budgets, cost alerts and Azure Advisor.

5 min

In a nutshell

Resource groups cannot be nested. A resource lives in exactly one group.
A move locks both resource groups while it runs, and the target subscription must be in the same tenant.
Moving a subscription to another directory removes its role assignments.

What it is

Azure organises everything in a hierarchy. Management groups hold subscriptions, subscriptions hold resource groups, and resource groups hold resources. Governance and access flow down this tree, and so do costs.

This page covers working with each level and keeping spending under control with budgets, alerts and Azure Advisor.

How it works

Resource groups

A resource group is a logical container for resources that share a lifecycle. Each resource belongs to one group. The group has a location, but this only stores metadata about the group, and resources in it can be in other regions.

Deleting a resource group deletes everything in it. Resource groups cannot be nested.

Moving resources

You can move resources to another resource group or another subscription from the portal, or with the command line. Keep these rules in mind.

Check that the resource type supports a move. Not all do.
Both the source and the target resource group are locked for changes while the move runs.
The resource ID changes, so anything that refers to it must be updated.
The target subscription must be in the same Microsoft Entra tenant.

Moving a virtual machine to another region is a different operation, handled by Azure Resource Mover.

Subscriptions

A subscription is the unit of billing and access. You can rename a subscription, move it between management groups, change its directory or cancel it. Moving a subscription to another Microsoft Entra directory removes its role assignments, because they refer to identities in the old directory.

Organisations use several subscriptions to separate environments or departments, so that billing and access can be managed separately.

Management groups

Management groups apply governance across many subscriptions. Every directory has a single tenant root group. A management group tree can be up to six levels deep, not counting the root and the subscription level.

Azure Policy assignments and role assignments made on a management group are inherited by every subscription beneath it. New subscriptions go to the default management group, which is the tenant root group unless you change it.

Costs: budgets and alerts

Microsoft Cost Management shows what you have spent and helps you control it.

Budgets set a spending amount for a scope, for a month, quarter or year. They send alerts when actual or forecast spend crosses a threshold you choose, for example 80 percent.
Action groups let a budget alert do more than email, such as start an automation.
Cost analysis groups spending by resource, resource group, tag or service.

A budget alerts you. It does not stop or delete resources.

Azure Advisor recommendations

Azure Advisor analyses your usage and recommends changes in five categories: reliability, security, performance, cost optimization and operational excellence. Cost recommendations include resizing or shutting down underused virtual machines and buying reserved capacity.

Moving resources safely

Before moving resources, work through a short checklist.

Confirm that the resource type supports a move to the target.
Move dependent resources together, such as a virtual machine with its disks and network interface.
Make sure the target subscription is in the same tenant and has the needed resource providers registered.
Expect the resource group to be locked for changes while the move runs.
Update scripts and references, because the resource ID changes.

A budget worked through

Marketing has a budget of 4,000 dollars a month on one subscription, and the finance team wants two warnings.

Setting	Value
Scope	The subscription, filtered by the tag Dept equals Marketing
Amount and period	4,000 dollars, monthly
Alert 1	80 percent of actual spend, email to the Marketing lead
Alert 2	100 percent of forecast spend, an action group

Remember that neither alert stops anything. To act, the action group must trigger an automation.

Placing subscriptions in management groups

New subscriptions land in the default management group, which is the tenant root group unless you change it. You can move a subscription to another management group, and it then inherits the policies and role assignments of its new parent. Moving it is how you apply a standard to a subscription without touching it directly.

How the exam asks about this

"Apply one policy to many subscriptions." A management group.
"Be told when forecast spending reaches the limit." A budget with a forecast alert.
"Which tool recommends shutting down idle virtual machines?" Azure Advisor.
"A subscription is moved to another directory." Its role assignments are removed.

What to remember for the exam

Resource groups cannot be nested. A resource lives in exactly one group.
A move locks both resource groups while it runs, and the target subscription must be in the same tenant.
Moving a subscription to another directory removes its role assignments.
Management groups nest up to six levels, excluding the root and subscription levels.
Policy and RBAC on a management group reach every subscription below it.
Budgets alert on actual or forecast spend and never stop resources.
Advisor gives recommendations in five categories, including cost.

Exam tip

"Apply this policy to ten subscriptions" points to a management group. "Warn finance at 80 percent of the monthly limit" points to a budget with an alert.

Common mistakes

Expecting a budget to cap spending. It sends alerts only.

Nesting resource groups. They cannot be nested. Use management groups above subscriptions.

Changing a subscription's directory and expecting access to stay. Role assignments are removed.

Forgetting that a move changes the resource ID. Scripts and references need updating.

Check yourself

What is the maximum depth of a management group tree, excluding the root and subscription levels?
Six levels.
Does an Azure budget stop resources when the threshold is reached?
No, it only sends alerts.
Which tool recommends resizing or shutting down underused virtual machines?
Azure Advisor.

Topic 4 of 4 in Manage Azure Identities and Governance

Test yourself on Manage Azure Identities and Governance

The full Microsoft AZ-104 question bank has 650 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.