Azure for People Who Did Not Come From Microsoft

The hierarchy: tenant, subscription, resource group

Other providers have an account and things inside it. Azure has four levels:

• Tenant — a Microsoft Entra ID directory. This is the identity boundary: users, groups, applications. One organisation, one tenant, usually.
• Management group — an optional grouping of subscriptions for applying policy at scale.
• Subscription — the billing and quota boundary. Costs roll up here, quotas apply here, and it is the level most people mean when they say “my Azure account”.
• Resource group — a container for resources that share a lifecycle. Deleting the group deletes everything in it.

The practical consequence: when someone hands you Azure access, ask which subscription, not just which login. Access to a tenant with no subscription role gets you a console with nothing in it.

Entra ID is not optional

Microsoft Entra ID — the service formerly called Azure Active Directory — is where users, service principals, managed identities and app registrations live. Every permission grant in Azure is a role assignment binding an Entra identity to a scope.

Three ideas cover most day-to-day work:

• Role-based access control (RBAC) — assign a role such as Contributor or Reader at a scope: subscription, resource group or single resource. Assignments inherit downward.
• Service principal — a non-human identity for a script or pipeline, with its own credentials.
• Managed identity — an identity Azure creates and rotates for a specific resource, so a VM or function can call other Azure services without a stored secret. Prefer this wherever it is available.

The services that carry most workloads

How Azure costs behave

Azure bills per resource per meter, like everyone else, but three things behave differently enough to plan around:

• Reservations and savings plans cut compute costs substantially for one- or three-year commitments. On steady workloads the discount is large enough that ignoring it is the single most expensive mistake.
• Azure Hybrid Benefit applies existing Windows Server and SQL Server licences to cloud VMs. If your organisation already holds those licences, Windows workloads become much cheaper here than elsewhere.
• Bandwidth out is charged per gigabyte after a small monthly allowance, and inter-region traffic is chargeable. Same shape as AWS.

Cost Management + Billing has budgets and alerts built in. Set one before deploying, not after the first invoice.

Free trial credit and what it is

Microsoft offers new accounts a time-limited credit, typically valid for thirty days, plus a set of services with always-free monthly allowances. The credit is applied against usage and expires unused. It is designed to let you try services, not to run production on.

Larger credit balances also exist through partner and startup programmes and are attached to a subscription rather than to a person. The Azure configurations we list are described by credit amount for that reason — the credit is the substantive difference between them. The current options are on the Buy Azure Account page.

Securing an Azure subscription

1. Sign in and change the password on the account you were given.
2. Enable multi-factor authentication for the identity.
3. Open Entra ID → Users and review every account in the directory. Remove anything unfamiliar.
4. Open Entra ID → App registrations and check for applications and client secrets you did not create.
5. Check Subscriptions → Access control (IAM) for role assignments at subscription scope.
6. Turn on Microsoft Defender for Cloud at least at the free tier for a baseline posture score.
7. Create a budget with an alert.

Steps three and four matter most. In Azure, an app registration with a valid client secret is a working credential that survives a password change, so an unexamined directory is the gap that lasts.

Common questions

Where to go next

If you are choosing between the big three, AWS versus Azure and Azure versus Google Cloud cover the decision from both sides. Account configurations and their credit balances are on the Azure account page.