A subscription is the payment agreement for how you’re going to pay the bill for your Azure usage to Microsoft. This means that every single resource you create is tied to a single subscription.
A subscription is connected to one AD tenant. It’s possible to move one subscription from one AD tenant to another AD.
Things you can apply to your subscription that will be inherited by all resources in that subscription:
- Policies
- RBAC
- Budget
An Azure subscription has a lot of limits that you need to be aware of exist, see https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits for an updated view. Example of limits are number of tags, resource groups etc.
What if we are a big company and need a lots of subscriptions? How do we manage them all?
This is where management groups come in play. Using management groups we can create a hierarchy of groups that manage subscriptions. At the top-level we have the root management group. A management group tree can support up to six levels of depth. So instead of applying policies, budgets and RBAC to specific subscriptions, we can apply them to the management groups instead.