Azure has a hierarchy that differs from AWS accounts.
flowchart TB
T[Entra ID tenant] --> M[Management groups]
M --> S[Subscriptions]
S --> R[Resource groups]
R --> X[Resources: VMs, storage, databases]
| Azure | Closest AWS idea |
|---|---|
| Subscription | Account (billing and limits boundary) |
| Resource group | A tag-like container; every resource lives in exactly one |
| Microsoft Entra ID | IAM identity source (renamed from Azure Active Directory in July 2023) |
| Azure RBAC role assignment | IAM policy attached to a principal |
| Region such as Central India | Region such as ap-south-1 |
Access is granted by assigning a role (Reader, Contributor, Owner) to a user, group or managed identity at a scope: management group, subscription, resource group or single resource. Assign to groups, not individuals, and at the narrowest scope that works.
Organise with one resource group per application and environment, so deleting the group removes everything it contains. Apply tags (Env, Owner, CostCenter) and Azure Policy to enforce them.