Azure Subscriptions: Billing, Access, and Structure Explained

What a subscription actually does

Every resource you create in Azure — a virtual machine, a storage account, a database — must belong to a subscription. The subscription plays two distinct roles:

1. Billing boundary. Azure calculates your costs per subscription and generates one invoice per subscription per billing period. If you want separate invoices for separate teams or business units, separate subscriptions achieve that.
2. Access boundary. You can grant users, service principals, and managed identities RBAC roles at the subscription level. A role granted at the subscription level applies to every resource group and resource inside it. This makes the subscription a convenient place to enforce organization-wide access policies.

A subscription is identified by a globally unique subscription ID (a UUID like a1b2c3d4-e5f6-7890-abcd-ef1234567890). You’ll see this ID constantly — in Azure CLI commands, in ARM templates, in error messages, and in Azure portal URLs.

# Show all subscriptions linked to your account
az account list --output table

# Show the currently active subscription
az account show --output table

# Switch to a specific subscription by ID or name
az account set --subscription "a1b2c3d4-e5f6-7890-abcd-ef1234567890"

Subscription types

Azure offers several subscription types, each suited to different situations.

Free trial

New Azure accounts get a 30-day free trial with a $200 credit. This is a single subscription tied to your email address. Once the credit is used or 30 days pass (whichever comes first), the subscription converts to pay-as-you-go unless you manually upgrade it. Services that exceed the free tier limits are blocked, not charged, while you’re in trial mode.

Pay-As-You-Go (PAYG)

Pay-As-You-Go is the default subscription type for individuals and small teams. You pay only for what you use, billed monthly to a credit card or bank account. There are no upfront commitments. This is the most flexible option but also the most expensive per-unit for sustained workloads.

Enterprise Agreement (EA)

Large organizations (typically 500+ users or $100,000+ annual Azure spend) sign an Enterprise Agreement with Microsoft. An EA gives you volume discounts, unified invoicing for all your subscriptions, and a dedicated Microsoft account team. EA subscriptions are managed through the EA portal rather than the standard Azure portal billing section.

Microsoft Customer Agreement (MCA)

A newer billing model that replaced the traditional EA process for many customers. It uses a hierarchy of billing accounts, billing profiles, and invoice sections. MCAs are more flexible than traditional EAs for managing multiple subscriptions with different cost centers.

Cloud Solution Provider (CSP)

When you buy Azure through a Microsoft partner (a managed service provider or reseller), you’re using a CSP subscription. Billing goes through the partner, who may offer additional support, bundled services, or custom pricing. The partner manages the subscription on your behalf but you retain control of your resources.

Dev/Test subscriptions

If you have a Visual Studio subscription (formerly MSDN), you get access to Azure Dev/Test pricing — significantly discounted rates for non-production workloads. Windows virtual machines, for example, cost far less on Dev/Test pricing because the Windows license is included in the Visual Studio subscription.

Subscriptions and tenants

A common point of confusion: subscriptions and tenants are related but separate things.

Your Microsoft Entra ID tenant is your organization’s identity directory. It holds user accounts, groups, applications, and policies. The tenant has its own ID (called the tenant ID or directory ID) and is typically associated with your organization’s domain (for example, acme.onmicrosoft.com or your custom domain acme.com).

A subscription is linked to exactly one tenant. When a user logs into the Azure portal and creates a resource, that action is authenticated through the tenant’s Entra ID. RBAC assignments on subscriptions reference users and groups that live in the tenant directory.

The relationship is:

• One tenant can own many subscriptions
• Each subscription belongs to exactly one tenant
• You can transfer a subscription to a different tenant (there are restrictions, and it requires Owner role on the subscription)

For most small organizations, there is one tenant and one or more subscriptions. For large enterprises with subsidiaries or distinct divisions, it’s possible to have multiple tenants, though this significantly increases complexity. See Azure resource hierarchy to understand how subscriptions fit into the broader organization structure.

When to use multiple subscriptions

Many teams start with a single subscription and outgrow it. Here are the most common reasons to add subscriptions:

Billing isolation

If your engineering team and your data science team have separate budgets, separate subscriptions let you see exactly what each team spends without parsing cost center tags. Each subscription gets its own invoice.

Access isolation

You might want to prevent developers from accidentally deploying changes to production. Putting production in a separate subscription means engineers need an explicit RBAC role on that subscription to touch it — no role, no access. This is cleaner than trying to manage it purely through resource group permissions.

Subscription limits

Each subscription has service quotas. For example, a subscription can have a maximum number of virtual CPUs per region. If your workload is large enough to hit these limits, splitting across subscriptions increases your effective capacity. See Azure quotas and limits for details.

Regulatory or compliance requirements

Some industries require strict separation between environments. A healthcare organization might keep PHI (protected health information) workloads in a dedicated subscription with its own compliance controls, separate from non-PHI workloads.

Worked example: how Acme Corp structures subscriptions

Acme Corp is a 200-person software company with a core product, a data analytics team, and a QA team that runs continuous testing. Here is how their subscriptions are structured:

All five subscriptions are under the same tenant (acme.com), managed from a single Entra ID directory. Microsoft Entra groups map to RBAC roles across subscriptions, so when a new engineer joins, adding them to the “engineers” Entra group automatically grants the right access to all relevant subscriptions.

Management Groups sit above all five subscriptions and enforce company-wide policies: for example, “all resources must have a cost-center tag” or “no public IP addresses in production.” You can read more about this in Azure resource hierarchy.

Subscription limits to know about

Subscriptions are not unlimited. Azure enforces default quotas on most resource types. Some important defaults:

• Virtual machine cores per region: 20 per family (e.g. 20 D-series cores in East US)
• Resource groups per subscription: 980
• Resources per resource group: 800 (for most resource types)
• Storage accounts per subscription per region: 250
• Virtual networks per subscription per region: 50

Many of these limits can be increased by submitting a quota increase request in the Azure portal. Navigate to Subscriptions → Usage + quotas to see your current usage and request increases. The process typically takes a few hours for compute quotas and is nearly always approved for legitimate requests.

Some limits are hard maximums that cannot be increased, which is a common reason teams split workloads across multiple subscriptions.

Creating and managing subscriptions

You can create new subscriptions from the Azure portal under Subscriptions → Add, or programmatically via the Azure CLI:

# List available subscription offers for your enrollment
az billing enrollment-account list

# Create a new subscription under an Enterprise Agreement
az account alias create \
  --name "acme-new-sandbox" \
  --billing-scope "/providers/Microsoft.Billing/billingAccounts/123456/enrollmentAccounts/789"

For Pay-As-You-Go accounts, subscription creation is done through the portal. The CLI-based creation shown above applies to EA and MCA billing accounts.

To rename a subscription or change its directory association, go to Subscriptions → [your subscription] → Rename or use the portal’s transfer subscription option. Renaming does not change the subscription ID.