A subscription in which nobody knows which resource belongs to what quickly becomes expensive and dangerous: nobody dares to delete, so everything stays put. In this lesson you bring order into it before the Kladde's first resource is created. You learn how Azure organizes resources, give the Kladde a naming scheme and tags, create its first resource group and protect it on a trial basis with a lock.
Four levels
Azure arranges everything in four levels:
Root management group (one per tenant)
└── Management group(s)
└── Subscription
└── Resource group
└── Resource
- Resources are the things that do something and cost something: a container app, a database, a storage account.
- Resource groups bring resources together. Every resource belongs to exactly one resource group.
- Subscriptions bring resource groups together and are the unit of billing (lesson 3.1.2).
- Management groups bring subscriptions together, so that rules and permissions don't have to be assigned for each subscription individually. Every tenant has exactly one root management group; new subscriptions land there unless something else is set. Below it, up to six levels can be formed, and every management group and every subscription has exactly one parent.
The most important thing about this hierarchy: permissions and policies act downward. Whoever has read access on a management group can read everything in all subscriptions below it. A policy “EU regions only” on the subscription applies to every resource group in it. You use this inheritance in lessons 3.1.4 and 3.1.5.
For the Kladde with a single subscription, you don't need a management group of your own. A company with dozens of subscriptions, on the other hand, can't do without them: there, for example, all subscriptions for production hang under one group with stricter rules than those for experiments. Course K4 builds such a structure.