AZ-900 Microsoft Azure Fundamentals Exam

Purpose and Benefits of Azure Subscriptions

An Azure subscription is a logical container that holds the products and services you acquire in Azure, such as virtual machines, databases, and support plans. Subscriptions themselves come at no cost; they exist solely to help you organize, manage, and bill for your resources. By grouping related services under a single subscription, you get a centralized view of everything you own in Azure.

Multiple subscriptions let you delegate management and apply different security or compliance policies across teams, departments, or projects. You can create separate subscriptions for development, testing, and production environments to reduce the risk of accidental changes. Subscriptions also support role-based access control (RBAC), allowing you to grant users specific roles at the subscription level. This layered model enhances security and simplifies administration.

The primary benefits of using Azure subscriptions include:

• Resource organization – Group related services under clear boundaries.
• Billing clarity – Track costs and set budgets per subscription.
• Access control – Enforce RBAC and isolate environments.
• Policy enforcement – Apply Azure Policy rules to ensure compliance.
• Scalability – Organize subscriptions into management groups for large enterprises.

These advantages help teams manage projects and environments effectively, promoting accountability and cost efficiency across your Azure estate.

Subscription Structure and Hierarchy

Azure subscriptions are part of a larger hierarchy that starts with the root management group, followed by management groups, then subscriptions, and finally resource groups that contain individual resources. This layered approach lets you scale governance from the company level down to specific workloads. Subscriptions inherit policies and permissions from their parent management group, so rules applied at a higher level automatically flow down to all child subscriptions.

Management groups sit above subscriptions and bundle them under a single governance umbrella. Applying a policy or access control at the management group level ensures consistent enforcement across all its subscriptions. You can move subscriptions between management groups using the Azure portal, Azure PowerShell, or the Azure CLI. When moving, you need permission at the child subscription or management group, the target parent, and the current parent, ensuring proper access control is maintained.

This hierarchical model provides centralized management, policy inheritance, and scalable governance. By organizing subscriptions under management groups, you can enforce security standards, control costs, and simplify access management at every level.

Subscription Management and Governance

You can manage Azure subscriptions using familiar tools: the Azure portal for a graphical interface, the Azure CLI for command-line automation, and Azure PowerShell for integration into existing scripts. These tools provide consistent ways to create, list, and filter subscriptions.

Governance is essential for secure and compliant management. Role-Based Access Control (RBAC) lets you assign roles such as Owner, Contributor, or Reader at the subscription level, controlling who can make changes. You can also configure subscription policies that govern whether subscriptions can be transferred into or out of a directory. Exempted users can bypass these policies for special scenarios. Effective cost management relies on clear subscription organization; many organizations use subscriptions to separate business units or environments, making it easier to allocate budgets and track spending. Azure Cost Management, budget alerts, and tags help enforce naming conventions and ensure consistent cost reporting.

Subscription Lifecycle and Limits

Creating an Azure subscription typically involves choosing an offer type (such as Pay-As-You-Go, Free Trial, or Enterprise Agreement) and specifying a directory. You can create subscriptions manually in the Azure portal, programmatically using the Subscription – Create REST API, or through Enterprise Agreement enrollment or Cloud Solution Provider (CSP) partners. When you create a subscription in another tenant, a subscription creation request is sent, and the target owner must accept it within seven days.

After creation, you view and manage subscriptions on the Subscriptions page in the portal, where you can filter by status, billing scope, or directory. Subscription policies control migrations between directories, with settings like Permit no one or Allow Everyone, and a list of exempted users can bypass these policies. To cancel or delete a subscription, you first delete all resources within it, leaving an empty container. Cancellation is effective immediately, but any outstanding charges for support or prepaid commitment may still apply.

Each subscription has limits and quotas that govern resource usage. For example, the Azure Automation service has default quotas per subscription per region, such as a maximum of 10 automation accounts and up to 50 concurrent jobs. To increase quotas, submit a Support request or check region availability. Understanding these service limits helps you plan capacity and ensures reliable operations.

Billing and Cost Management

Azure subscriptions are the primary billing containers. Each subscription is linked to a billing account, which tracks invoices, payments, and usage details. Within a billing account, you can view and download invoices, manage payment methods, and assign Owner, Contributor, or Reader roles to control who can view or pay bills. Properly configuring your billing account ensures charges flow to the correct subscription.

Azure Cost Management + Billing provides tools for monitoring and optimizing spending. Features include cost analysis to slice and filter costs by service, resource group, or tag; budgets and alerts for spending limits and notifications; and exports to automate cost data to storage. Access control uses RBAC at different scopes: management groups, subscriptions, and resource groups. Roles cascade down from higher scopes, ensuring consistent permissions.

Cost optimization is key to efficient cloud spending. Azure offers Azure Advisor for tailored cost-saving suggestions, Azure Reservations and Savings Plans for discounted rates when you prepay or commit to resources, and Azure Hybrid Benefit to use existing on-premises licenses to lower costs. Adopting these strategies can lead to significant savings while keeping workloads running smoothly.