An Azure subscription is the container where Azure resources live and the billing entity that receives the invoice. It creates a practical boundary for organizing resources, costs, and access. section 6.6.1
Subscriptions sit inside a Microsoft Entra ID tenant. One tenant can contain several subscriptions—for example, separate development, production, and legal-hold environments—while each subscription belongs to one tenant. section 6.6.1
Keep the boundaries straight:
- The tenant contains users, groups, applications, and identity policies. section 6.6.1
- The subscription contains resource groups and Azure resources such as virtual machines, storage accounts, and web apps. section 6.6.1
- Entra ID checks who is signing in, which tenant they belong to, whether they can access the subscription, and what they may do; RBAC handles the final permissions question. section 6.6 section 6.6.1
A subscription in practice
A small image-processing application can use a free Azure subscription while it stores images and compresses them through connected Azure services. Later, the team might create separate development and production subscriptions, keeping both under the same tenant while separating resources and invoices. section 2.0 section 6.6.1
Choosing a subscription
When creating a Key Vault in the Azure Portal, choose the subscription where the vault should live, then select or create its resource group. The subscription choice determines the resource's organizational and billing home. section 6.8.1
Figure 6.29 Relationship between an Entra ID tenant, users, subscriptions, and resources. Users and groups belong to the tenant. Subscriptions exist within the tenant, and each subscription contains resource groups, which in turn contain Azure resources.
Use the hierarchy diagram to see how an Entra ID tenant contains subscriptions, how subscriptions contain resource groups, and how resources fit beneath them. section 6.6.1
