Azure Subscriptions, Tenants and Pay-As-You-Go

Azure has more named layers than most providers, and the names are not self-explanatory. Three matter in practice: the tenant, the subscription and the resource group.

The tenant is identity

A tenant is a directory instance holding users, groups and applications. It is the identity plane. One organisation typically has one tenant, and identities in it can be granted access to resources across many subscriptions.

Because identity lives here rather than in the subscription, removing someone from a subscription does not necessarily remove their account. On an inherited environment, look at both layers.

The subscription is billing and quota

A subscription is the billing container and the quota boundary. Charges accrue to it, limits are enforced against it, and it is the object that can be suspended when payment fails.

A tenant can hold several subscriptions, which is how organisations separate production from development while keeping one identity directory. When people talk about an Azure account, they usually mean a subscription.

Resource groups are lifecycle containers

Within a subscription, every resource belongs to exactly one resource group. A resource group is a lifecycle boundary: deleting it deletes everything inside.

That makes resource groups the cleanest tool for temporary work. Put an experiment in its own group and you can remove every trace of it with one action, which is far more reliable than hunting individual resources later.

What pay-as-you-go means

A free trial subscription carries a promotional balance and a spending cap that stops resources rather than letting them bill. Converting to pay-as-you-go removes that cap and attaches ongoing consumption to the payment method.

The distinction matters. A trial subscription protects you from surprise charges by halting your workload. A pay-as-you-go subscription keeps your workload running and sends you the bill. For anything you need to stay up, the latter is required; for cautious experimentation, the former is a feature rather than a limitation.

Current catalogue options

Matching configuration to need

Profiles carrying a promotional balance suit evaluation and short projects. Pay-as-you-go readiness matters when the workload must not stop when a balance runs out. Larger credit tiers suit planned pieces of work with a known budget.

Whichever you choose, the balance is dated and service-restricted. See how cloud credits are applied for what that means in practice.

First tasks

1. Change the password and configure a second factor on the account you will use.
2. Review directory users and role assignments at both tenant and subscription level.
3. List resource groups and identify anything running that you did not create.
4. Set a budget with alerts in Cost Management.
5. Confirm the spending cap state so you know whether workloads will stop or bill.

Microsoft’s terms of service continue to govern use of the subscription throughout.