Tenant

A Tenant refers to instances in Azure AD. Whenever a user creates an account on Azure, Azure automatically creates their identity in Azure AD which is a single place to manage all users and groups. Azure AD allows managing permissions on each user and group. Some of may thick we use Azure as an application which can be right. Every application running in Microsoft 365 needs an account to access them. Organizations create a user in Azure AD and assign that user permission accordingly. Each Azure AD tenant is globally unique and has a ‘Tenant ID’ in the form of a UUID/GUID. Organizations can connect their on-premise Active Directory to Azure AD to allow single sign-on.

Management group

This allows the administrator to manage access, policy, and compliance across multiple Azure subscriptions. The administrator can create a hierarchy to allocate subscriptions to different groups or departments. This helps to use with other Azure services such as Azure Policy and Azure Role-Based Access Control (RBAC). This can go six levels deep in the hierarchy.

Subscription

It is considered as a logical container where multiple resources can be used such as VMs, Web Apps, and storage accounts. This is used to keep track of the resources that each tenant use. We take leverage of RBAC or management groups to use subscriptions in a particular way. Subscription assigned with a single Azure AD tenant and every subscription has a display name (which can be changed) and subscription ID (cannot change). The company can have multiple subscriptions in every department to record the usage and budget accordingly.

Resource group

A resource group is a logical container that contains every resource from a single instance or service. It is also used to manage them as a single entity where multiple resources of each instance manage collectively. For example, whenever a user creates a VM, Azure automatically creates its other components such as storage, network, CPU, memory, etc. All of those components need to reside in the same resource group.

Resources

A resource can be identified by service. Resources are the actual stuff such as subnet, IP address, and storage and it is stored in a resource group. Resource groups, subscriptions, and tags are also examples of resources.

The below diagram helps you visualize the hierarchy of Azure management groups