Azure Subscriptions
😟 THE PROBLEM
One giant Azure bill, and nobody knows which department spent what.
😊 THE SOLUTION
Use separate subscriptions as billing and access boundaries.
- One bill for everyone✓ A separate bill per subscription
- Everyone can access everything✓ Access rules per subscription
- Dev experiments next to production✓ Separate dev and prod subscriptions
Quick answer
An Azure subscription is a logical unit that links your Azure account to billing, and acts as both a billing boundary and an access control boundary. All resource groups and resources live inside a subscription. Organisations often create several subscriptions to separate environments, departments or billing.
Exam objective: 2.1.5 Describe subscriptions. (Skills measured as of July 20, 2026)
Start with a question
How does the finance team know which department spent what on Azure?
If everything is on one bill, nobody knows. Azure’s answer is the subscription: each one gets its own bill and its own access rules.
Explain it like I’m 10
The technical explanation
An Azure subscription provides authenticated and authorised access to Azure services and is tied to a billing arrangement. It sits between management groups and resource groups in the hierarchy.
| Boundary | What it does |
|---|---|
| Billing | Each subscription generates its own invoices and cost reports |
| Access control | Apply RBAC roles and Azure Policy to everything in the subscription |
Common reasons for multiple subscriptions: environments (prod, dev, test), organisational structure (departments or teams), billing (cost centres), and limits (each subscription has quotas).
Real-world business scenario
A university
- The problem
- Research groups, IT and the student portal shared one subscription; nobody could tell who spent what, and researchers had access to the student database.
- What they used
- Created separate subscriptions for IT production, the student portal and each research faculty.
- Why that choice
- Subscriptions give separate bills and separate access boundaries.
- The result
- Each faculty receives its own Azure bill, and research staff no longer have access to student systems.
When to use it and when not to
✓ Use it when…
- Separate production from development and test.
- Give departments or customers their own bill and access boundary.
✕ Think twice when…
- Creating a subscription for every tiny project. Resource groups are often enough.
↔ Alternatives to consider
- **Resource groups and tags** for finer-grained organisation inside one subscription.
Interview preparation
Say your answer out loud first, then open the model answer. Interviewers care more about your reasoning than the exact words.
Beginner What is an Azure subscription?
Model answer
It is the container that links Azure resources to billing. Everything I create lives in a subscription, and I can control who has access and see costs at the subscription level.
Intermediate Why would a company use more than one subscription?
Model answer
To separate environments such as production and development, to separate departments or projects for billing, to apply different access and policies, and to stay within subscription limits and quotas.
Experienced developer How do subscriptions fit into an enterprise landing zone design?
Model answer
Subscriptions are the unit of scale and isolation. A landing zone typically gives each workload, or each workload environment, its own subscription, placed under management groups that apply shared policies. Platform subscriptions hold shared services such as connectivity and identity. This keeps blast radius small and billing clear.
Test yourself with exercises
3 original practice questions in the AZ-900 style. Pick your answers, then check them. You will see why each option is right or wrong. Score 75% or more and this topic is marked complete.
Quick revision
Key points
- A subscription links Azure usage to billing.
- It is a billing boundary and an access control boundary.
- Resource groups and resources live inside subscriptions.
- One account can have multiple subscriptions.
Important terminology
- Subscription
- A container for resources that is a billing boundary and an access control boundary.
- Billing boundary
- Each subscription gets its own invoices and cost reports.
- Access control boundary
- Permissions and policies can be applied at the subscription level for everything inside.
- Azure account
- The identity (in a Microsoft Entra tenant) used to sign in and own subscriptions.
Common mistakes
- Confusing subscriptions with resource groups. Subscriptions contain resource groups.
Exam tips
- "Separate invoices for different departments" = use separate subscriptions.
- The two boundaries are billing and access control.
Five quick revision questions
-
1.What two boundaries does a subscription provide?Show
A billing boundary and an access control boundary.
-
2.What does a subscription contain?Show
Resource groups, which contain resources.
-
3.Can one account have several subscriptions?Show
Yes.
-
4.Why separate production and development into different subscriptions?Show
To isolate access, policies, quotas and costs.
-
5.What groups several subscriptions for shared governance?Show
A management group.
Official references
Finished this lesson? Tick it off. Your progress is saved in this browser.
Next up: Management Groups