Azure Subscription & Management Group Administration: A Complete Enterprise Guide

 Managing cloud at scale goes beyond deploying resources—it requires a robust administrative structure that ensures security, governance, compliance, cost control, and operational consistency across thousands of resources and multiple teams.

Azure provides two foundational constructs for enterprise governance:

1. Management Groups – hierarchical containers for governance

2. Subscriptions – billing and isolation boundaries for workloads

Together, they form the backbone of Azure's Cloud Governance and Enterprise Landing Zone architecture.

This guide dives deep into how enterprises can design, administer, secure, automate, and audit Azure subscriptions and management groups effectively.

---

1. Azure Management Groups: Enterprise Governance Backbone

A Management Group (MG) is a top-level container used to apply governance and security before resources or subscriptions are created.

It sits above subscriptions in the hierarchy:

Tenant (root)
   └── Management Groups
         └── Subscriptions
               └── Resource Groups
                     └── Resources

Management Groups allow enterprises to:

• Apply policies

• Enforce RBAC roles

• Enforce compliance

• Organize subscriptions

• Inherit governance down the hierarchy

• Standardize cloud operations

---

1.1 Key Features of Management Groups

✔ 1. Hierarchical Governance

You can create a hierarchy like:

Root
 ├── Platform
 │    ├── Security
 │    └── Networking
 └── Landing Zones
      ├── Dev
      ├── UAT
      └── Prod

Each level inherits:

• Policies

• RBAC

• Blueprints

• Compliance controls

---

✔ 2. Centralized Policy Enforcement

Examples of policies applied at top layers:

• Allowed locations

• Enforce tagging

• Enforce encryption

• Restrict allowed SKUs

• Security baseline (CIS/PCI/ISO)

All subscriptions under the MG automatically inherit these.

---

✔ 3. Platform Separation & Segregation of Duties

Different teams manage different management groups:

• Security Team → Security MG

• Platform Team → Landing zone MG

• DevOps Team → Application subscriptions

• Network Team → Connectivity MG

Ensures compliance with enterprise governance.

---

✔ 4. Multi-Subscription Landing Zones

Each application or business unit can have:

• Dev

• Stage

• UAT

• Prod

Subscriptions under separate MGs improve:

• Cost visibility

• Isolation

• RBAC segmentation

• Compliance

---

1.2 Management Group Naming Standards

Use clear and intuitive names:

mg-root  
mg-platform  
mg-security  
mg-connectivity  
mg-landingzones  
mg-prod  
mg-dev  
mg-shared

---

1.3 Creating Management Groups

Azure CLI

az account management-group create --name mg-prod

PowerShell

New-AzManagementGroup -GroupId mg-prod

---

1.4 Assigning Policies at MG level

Azure CLI

az policy assignment create \
  --name "allowed-locations" \
  --policy "/providers/Microsoft.Authorization/policyDefinitions/allowedLocations" \
  --scope "/providers/Microsoft.Management/managementGroups/mg-prod"

Policies apply automatically to all child subscriptions.

---

2. Azure Subscription Administration: Isolation, Billing & Access Control

An Azure Subscription is the boundary for:

• Billing

• Role-based access (RBAC)

• Quotas

• Invoices

• Resource limits

• Support plans

• Cost visibility

Subscriptions help separate:

• Business units

• Environments

• Teams

• Applications

• Regulatory workloads

---

2.1 What Subscriptions Provide in Enterprise Environments

✔ Billing Segmentation

Each subscription receives an invoice → easy cost chargeback.

✔ Security Segmentation

Design subscriptions for:

• Prod

• UAT

• Dev

• Sandbox

• Shared services

✔ Quota Isolation

Each subscription provides its own:

• VM quota

• Storage quota

• IP quota

• AKS node pool quota

✔ Fault Isolation

Failure in one subscription won't affect others.

---

2.2 Subscription Naming Standard

Follow this structure:

<Org>-<BusinessUnit>-<Env>-sub

Examples:

inplaysoft-core-prod-sub
inplaysoft-platform-dev-sub
inplaysoft-security-shared-sub

---

2.3 Subscription Ownership & Access Strategy

✔ Best Practice: Assign Access to Azure AD Groups

Avoid assigning roles to individuals.

Example:

Group: AppTeam-Prod-Contributors  
Role: Contributor  
Scope: Prod Subscription  

✔ Avoid Using Owner Role

Prefer:

• Contributor

• Reader

• User Access Administrator (only when needed)

---

2.4 Creating a Subscription Programmatically

Using Azure CLI

az account subscription create --offer-type MS-AZR-0017P

Move subscription under an MG

az account management-group subscription add \
    --name <subscriptionId> \
    --management-group mg-prod

---

3. Subscription Governance Using Policies & RBAC

3.1 Apply RBAC at Subscription Level

Assign Contributor Developer group:

az role assignment create \
  --assignee "<group-object-id>" \
  --role Contributor \
  --scope "/subscriptions/<subscription-id>"

3.2 Apply Policies at Subscription Level

Enforce allowed VM sizes:

az policy assignment create \
  --name restrict-vm-skus \
  --policy "/providers/Microsoft.Authorization/policyDefinitions/allowedVmSizes" \
  --scope "/subscriptions/<subscription-id>"

---

4. Enterprise Subscription Strategy Models

Model 1: Per-Environment Subscription

app1-dev-sub  
app1-uatsub  
app1-prod-sub

Model 2: Per-Business Unit Subscription

finance-sub  
marketing-sub  
data-sub

Model 3: Per-Application Subscription

Useful for large-scale microservice organizations.

Model 4: Shared Services Subscription

• Networking

• ACR/ECR

• Key Vault

• Identity workflows

• Firewalls

• DNS

---

5. Azure Management Group + Subscription Reference Architecture

mg-root  
 |
 ├── mg-platform
 │     ├── mg-connectivity
 │     └── mg-security
 |
 └── mg-landingzones
       ├── mg-dev
       ├── mg-test
       ├── mg-uats
       ├── mg-prod
       └── mg-sandbox

Each MG contains subscriptions like:

inplaysoft-dev-sub  
inplaysoft-prod-sub
inplaysoft-network-sub
inplaysoft-security-sub

This matches Microsoft's Enterprise Landing Zone (ELZ) architecture.

---

6. Subscription Cost Governance

✔ Use Azure Budgets per subscription

✔ Enable Cost Anomaly Detection

✔ Tag resources with CostCenter, Owner, Environment

✔ Use Azure Policy to enforce mandatory Tagging

CLI Example:

az consumption budget create \
  --amount 5000 \
  --category cost \
  --scope "/subscriptions/<subscription-id>" \
  --time-grain monthly \
  --name ProdBudget

---

7. Security & Compliance for Subscription Administration

✔ Azure AD Conditional Access

MFA + compliant device enforcement.

✔ Privileged Identity Management (PIM)

Manage temporary access elevation.

✔ SAC (Secure Access Controls)

Limit subscription-level permissions.

✔ Break-Glass Accounts

Emergency accounts for disaster scenarios.

✔ Activity Logs & Audit Logs

Monitor admin actions.

---

8. Automation for Subscription & MG Management

8.1 Using Terraform

Terraform supports:

• Subscription assignment

• Management groups

• Policy assignments

• RBAC roles

• Automation of landing zone creation

Example MG in Terraform:

resource "azurerm_management_group" "prod" {
  display_name = "mg-prod"
  name         = "mg-prod"
}

---

8.2 Using Bicep

Azure-native:

resource mg 'Microsoft.Management/managementGroups@2021-04-01' = {
  name: 'mg-prod'
}

---

8.3 Using Azure Blueprints (Deprecated but replaced by Azure Landing Zones)

Blueprints used templates and policies across subscriptions—now replaced with Azure Landing Zone Accelerator.

---

9. Monitoring & Audit Requirements

What to monitor:

✔ Subscription Activity Logs
✔ Policy compliance
✔ RBAC assignments
✔ Failed authentication
✔ Cost spikes
✔ VM creation/deletion attempts
✔ Firewall rule changes
✔ Key Vault access

CLI Example:

az monitor activity-log list --subscription <sub>

---

10. Best Practices for Subscription & Management Group Administration

Management Group Best Practices

• Always enable the root management group

• Never assign human users at the root

• Apply global policies at the root level

• Design MG hierarchy before creating subscriptions

• Use separate MGs for platform vs landing zones

Subscription Best Practices

• Separate dev/test/prod subscriptions

• Assign roles to AD groups, not individuals

• Limit Subscription Owners

• Use Azure Policies consistently

• Automate subscription creation using workflows

Security Best Practices

• Enable MFA everywhere

• Use Azure PIM for admin access

• Monitor audit logs

• Apply locks to critical subscriptions

• Use Key Vault for secret management

Cost Control Best Practices

• Enforce tagging policies

• Apply budgets per subscription

• Cloud cost anomaly detection

• Monthly optimization reports

---

Conclusion

Azure Management Groups and Subscriptions are the foundation of any enterprise Azure architecture. Proper implementation ensures:

• Scalable governance

• Secure cloud operations

• Cost-effective environment separation

• Compliance enforcement

• Operational consistency across teams

Enterprises that design their subscription and management group strategy upfront avoid technical debt, reduce operational risk, and achieve true cloud maturity aligned with Azure’s best practices.