Azure Resource Groups and Subscriptions Explained Simply: Your Complete UK Beginner's Guide
Take the free IT Readiness Test and see where you stand, 10 quick questions.
If you're moving into IT from healthcare or any other background, Azure can feel overwhelming at first. But here's the truth: once you understand resource groups and subscriptions, the whole platform becomes a lot clearer. These two concepts are the foundation of how you'll organise everything in Microsoft Azure.
Let me break this down in plain terms, without the corporate jargon.
What's the difference between subscriptions and resource groups?
Think of it this way. An Azure subscription is like your contract with Microsoft. It's your billing boundary, your security boundary, and your permission boundary all rolled into one. When you sign up for Azure, Microsoft gives you a subscription ID. Everything you build, every pound you spend, every permission you have or don't have, flows through that subscription.
A resource group, on the other hand, is a container inside your subscription. It's where you actually put your stuff. Virtual machines, databases, storage accounts, web apps, everything goes into a resource group.
One subscription can hold many resource groups. One resource group can hold many resources. That's the hierarchy.
Here's a practical example. Imagine you work for an NHS trust managing cloud infrastructure. Your subscription is like your department's budget account with Azure. Your resource groups might be organised by team: "Cardiology-Resources", "Radiology-Resources", "Administration-Resources". Each team controls what's in their resource group, but the subscription owner controls the overall budget and who has access to the subscription itself.
How subscriptions work in Azure
A subscription is your entry point to Azure. Without one, you can't create anything. It's where Microsoft tracks your spending and where you set up billing.
You can have multiple subscriptions. Big organisations often do. For example, they might have one subscription for development, one for testing, and one for production. That way, if a developer accidentally deletes everything in the dev subscription, it doesn't touch production.
Each subscription has its own:
From a career perspective, understanding subscriptions is crucial. If you're aiming for an Azure Administrator role (which starts around £28,000 to £35,000 in the UK depending on region), you'll need to know how to manage subscriptions, move resources between them, and understand the cost implications.
How resource groups work in Azure
Resource groups are where the actual work happens. They're containers, but they're smart containers.
Every resource in Azure must belong to exactly one resource group. You can't create a virtual machine without putting it in a resource group. You can't create a database without specifying which resource group it goes in.
Here's what matters about resource groups:
Organisation. You group related resources together by project, by team, by environment, or by cost centre. Your choice.
Access control. You can give specific people or teams permission to manage all resources in a resource group without giving them access to other resource groups. This is hugely important in secure, professional environments.
Lifecycle management. When you're done with a project, you delete the resource group, and everything in it disappears instantly. No orphaned resources hanging around costing you money.
Monitoring and billing. You can track costs per resource group, so you know exactly how much each project is spending.
Region assignment. A resource group has a region (like "UK South" or "Europe West 1"). This affects where your data sits and can impact latency and compliance.
The practical side: as an IT Support technician moving into cloud roles, you'll learn to create, manage, and delete resource groups. It becomes muscle memory very quickly.
Real example: setting up your first Azure environment
Let's say you're learning Azure for the first time. You create a subscription (or your organisation gives you access to one). You're working on a project to migrate a small clinic's medical records system to the cloud.
Step one: create a resource group called "ClinicRecords-Dev". That's your development environment.
Step two: in that resource group, you create a virtual machine, a database, and a storage account. These three resources are now linked together by the resource group.
Step three: you give your team lead access to just that resource group. They can see and manage everything inside it, but they can't see other resource groups in the subscription.
Step four: when development is done, you create a second resource group called "ClinicRecords-Prod". You deploy the production version there.
Step five: at the end of the project, you delete "ClinicRecords-Dev" and everything in it vanishes. No manual cleanup, no forgotten resources eating your budget.
That's how subscriptions and resource groups work in practice.
Common mistakes people make
One huge mistake is creating one massive resource group for everything. That works for a tiny hobby project, but it's chaos in a real organisation. You lose visibility, you can't delegate permissions properly, and if something goes wrong, it's hard to isolate.
Another common error is treating subscriptions as just "different Azure accounts". They're not. A subscription is a logical boundary within your Azure enterprise, and moving resources between subscriptions is possible (though not automatic) when your needs change.
People also forget that deleting a resource group deletes everything inside it instantly, with no undo button. It's a powerful feature, but it demands respect.
Why this matters for your IT career
If you're training to be an Azure Administrator, this isn't theoretical. The AZ-104 exam dedicates significant weight to subscriptions, resource groups, and access control. You need to understand how to create them, delegate permissions, move resources, and manage costs.
For IT Support professionals moving into cloud administration, mastering this concept early means you'll handle real projects faster and with more confidence. Organisations managing healthcare data especially need staff who understand how to partition and control access properly.
This is foundational knowledge that separates someone who can click buttons from someone who can design and manage Azure environments securely.
If you're not sure whether Azure Administration is the right path for you, or you want to explore cloud careers more broadly, take our free AI career pathway tool at smoothops365.com/roadmap. It'll help you figure out which Azure role matches your background and goals, and what training you actually need.
Frequently asked questions
Can I have multiple resource groups in one subscription?
Yes, absolutely. You can create as many resource groups as you need within a single subscription. There's no practical limit (though Azure has soft limits you can request to increase). Most organisations organise by project, team, or environment: development, testing, and production resource groups are common.
If I delete a resource group, can I get my resources back?
No. Deleting a resource group is permanent and immediate. Everything inside it (virtual machines, databases, storage accounts, all of it) is deleted without recovery options. Always make backups of critical data before deleting a resource group, and be very careful with the delete button.
Do I need a separate subscription for each project?
Not necessarily. Many organisations use a single subscription with multiple resource groups, one per project. However, larger enterprises often split subscriptions by environment (dev, test, prod) for billing clarity and to prevent accidental changes in production.
How do subscriptions and resource groups affect my Azure costs?
Subscriptions are your billing boundary. You receive one bill per subscription. Resource groups themselves don't cost money, but all resources inside them do. Tracking costs per resource group helps you see which projects or teams are spending what, making it easier to manage your cloud budget.
Can someone access one resource group but not another in the same subscription?
Yes, that's the whole point of resource groups for permissions. You can use Azure's role-based access control (RBAC) to give someone full permission to manage a specific resource group while denying them access to everything else in the subscription. This is how organisations protect sensitive environments.
SmoothOps 365 runs live instructor-led training every Saturday and Sunday. 3 months. 50 contact hours. Keep your job while you train.