AI-generated content
Transcribed
Azure Management Groups and Subscriptions - Simply Explained
Oct 21, 2026 ·
14m 26s
Download and listen anywhere
Download your favorite episodes and enjoy them, wherever you are! Sign up or log in now to access offline listening.
Azure Management Groups and Subscriptions - Simply Explained
Description
Once an Azure tenant grows past a handful of subscriptions, permissions, policies and costs drift out of control. This Simply Explained episode is for admins and cloud teams who need...
show more
Once an Azure tenant grows past a handful of subscriptions, permissions, policies and costs drift out of control. This Simply Explained episode is for admins and cloud teams who need a clear map of the Azure hierarchy. It shows how management groups and subscriptions work together so you can set rules once and see costs in one place.
In this episode
Key takeaways
Worth quoting
“Azure isn't hard because the individual pieces are complicated because most of them aren't. It gets hard because the pieces multiply and multiplication without structure turns into noise.” – Mirko Peters (00:50)
“You might think more subscriptions means more control, but the opposite is true because more subscriptions means more places for the rules to drift.” – Mirko Peters (04:22)
Explore more on M365.FM
Follow and rate M365.FM in your podcast app, and join the free M365 community at m365con.net.
Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-microsoft-365-azure-cloud-power-platform-ai--6704921/support.
This episode includes AI-generated content.
show less
In this episode
- 00:00 – Why Azure turns into a mess without a map
- 02:35 – The subscription is where your Azure actually lives
- 04:36 – Management groups are the folder above your subscriptions
- 06:52 – How permissions and policies flow down the tree
- 09:43 – What a good structure actually looks like
- 12:05 – Naming, cost boundaries and keeping it sane
- 14:05 – A quick recap and one question
Key takeaways
- Subscriptions carry billing, quotas and the link to one Microsoft Entra tenant, while management groups sit above them purely for governance.
- Access (RBAC) and Azure Policy assigned at a management group are inherited by every subscription and resource below it, and a deny higher up cannot be overridden lower down.
- Follow the landing zone pattern: keep the hierarchy flat with platform, landing zones, sandbox and decommissioned branches, and use management group views to roll up usage costs.
Worth quoting
“Azure isn't hard because the individual pieces are complicated because most of them aren't. It gets hard because the pieces multiply and multiplication without structure turns into noise.” – Mirko Peters (00:50)
“You might think more subscriptions means more control, but the opposite is true because more subscriptions means more places for the rules to drift.” – Mirko Peters (04:22)
Explore more on M365.FM
- Episode page: the full episode with chapters, quotes and an FAQ on the Azure hierarchy
- Azure landing zone – Microsoft's blueprint whose management group hierarchy the episode uses as the model structure
- Microsoft Azure – the cloud platform whose tree of management groups, subscriptions and resources the episode maps
- Governance – the rules and permissions that management groups exist to apply across many subscriptions
- Related episode: Microsoft Entra Tenant Governance - Simply Explained
Follow and rate M365.FM in your podcast app, and join the free M365 community at m365con.net.
Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-microsoft-365-azure-cloud-power-platform-ai--6704921/support.
This episode includes AI-generated content.
Information
| Author | Mirko Peters M365, Azure & AI |
| Organization | m365 FM |
| Website | www.m365.fm |
| Tags |
Copyright 2026 - Spreaker Inc. an iHeartMedia Company
Comments