Subscriptions and management groups: hierarchy, inheritance of policy and RBAC

Azure organizes resources in a four-level hierarchy: management groups contain subscriptions, subscriptions contain resource groups, and resource groups contain resources. Understanding the hierarchy is essential because role-based access control (RBAC) role assignments and Azure Policy assignments made at any level flow down to everything beneath it. If you know where an assignment was made, you can predict exactly which resources it affects, today and in the future.