Azure resources, resource groups, subscriptions and management groups: the hierarchy and what each is for

Azure organizes everything you create into a four-level hierarchy: management groups, subscriptions, resource groups and resources. Knowing what each level is for, and how settings flow from top to bottom, is one of the most tested areas of the Microsoft Azure Fundamentals exam (AZ-900). At the bottom are resources: individual things you create and pay for, such as a virtual machine, a virtual network, a storage account or a database. Every resource is created and managed through Azure Resource Manager (ARM), the deployment and management layer behind the portal, the command line and templates. Every resource must belong to exactly one resource group. A resource group is a logical container for resources that share a lifecycle, such as all the parts of one application or one environment. Resource groups cannot be nested. Deleting a resource group deletes every resource inside it, which makes them handy for labs and temporary environments. You can apply role-based access control (RBAC) permissions, policies, locks and tags to a resource group, and resources inside inherit the permissions and policies. A resource group has a location that stores its metadata, but it can contain resources in other regions. Most resources can be moved between resource groups and subscriptions.