Hierarchical Organization

Azure uses a logical hierarchy to manage permissions, billing, and policies across large enterprises.

1. The Hierarchy

- **Management Groups:** Manage multiple Subscriptions (Policy/RBAC inheritance).
- **Subscriptions:** The unit of billing and quota limits.
- **Resource Groups:** A logical container for resources that share the same lifecycle.
- **Resources:** Individual items (SQL, VM, Web App).

2. Resource Group Strategy

**Standard Pattern:** Put all resources for a single environment of a single app into one Resource Group (e.g., rg-toolliyo-prod-weu). When you want to 'Delete' the app, you just delete the Resource Group, and everything—IPs, Disks, Secrets—is wiped out cleanly.

3. Architect Insight

Q: "Should I use Tags or Resource Groups for billing?"

Architect Answer: "Use BOTH. Resource Groups are your primary 'Lifecycle' boundary. Tags (like Owner: Marketing) are your primary 'Financial' boundary. You can run a cost report across 10 different Resource Groups as long as they all share the same Marketing tag. This is how you handle shared costs like Networking or Hub-and-Spoke firewalls."