Azure: subscriptions, resource groups, regions, portal, Cloud Shell and az CLI

Objective

Understand how an Azure account is organized (who pays, who manages, where resources live), choose a region suited to a Moroccan customer, and take your first steps with the portal, Cloud Shell and az CLI.

General concepts (IaaS, PaaS, SaaS, the shared responsibility model, CapEx and OpEx) are covered in the "Cloud" (fundamentals) course. Here, we focus on how Azure implements them.

Key points

• Everything starts from a Microsoft Entra ID tenant (the company directory). It contains subscriptions, which are the unit of billing and of limits.
• A resource (VM, disk, database…) always belongs to a single resource group, which itself sits in a single subscription.
• Four scope levels for permissions and policies: management group → subscription → resource group → resource. What is granted at the top is inherited below.
• There is no Azure region in Morocco (yet): the closest are France Central (francecentral), Spain Central (spaincentral) and West Europe (westeurope).
• az CLI is the cross-platform command-line tool; Cloud Shell gives it to you already signed in, in the browser.

1. The hierarchy of an Azure account

Take a chain of stores in Casablanca, "Boutique Atlas", that moves its IT to Azure:

Entra ID tenant: boutiqueatlas.ma
└── Root management group
    ├── MG "Production"
    │   └── Subscription "Boutique-Prod"     ← one bill, one budget
    │       ├── rg-boutique-prod              ← the website and its database
    │       └── rg-reseau-prod                ← virtual networks, VPN
    └── MG "Non-production"
        └── Subscription "Boutique-Dev"
            └── rg-boutique-dev

Rules to know:

• A resource group has a region (where its metadata is stored), but it can contain resources from other regions.
• Deleting a resource group deletes everything it contains. This is handy for a test environment, and dangerous in production.
• A resource can be moved from one group to another (most types allow it), but not nested: there is no group inside a group.

How many subscriptions?

A common practice: one subscription per environment (production, preproduction, development), or even one per customer for an IT services company. This separates bills, quotas and permissions. Management groups avoid repeating the same rules on every subscription.

2. Regions and availability zones

A region is a set of nearby data centers (for example France Central, near Paris). Many regions have three availability zones: separate data centers (independent power, cooling and network) within the same region.

# list the regions and their short names
az account list-locations --output table

# the VM sizes available in a region
az vm list-sizes --location francecentral --output table

Commands always expect the short name (francecentral), never the display name ("France Central").

3. The Azure portal

The portal (portal.azure.com) is the web interface. It is perfect for discovering, visualizing (network diagrams, costs, metrics) and troubleshooting. A few landmarks:

• the search bar at the top finds a service, a resource or documentation;
• Resource groups: the "per project" view;
• Cost Management + Billing: budgets and cost analysis;
• the Cloud Shell button (>_ icon) opens a terminal at the bottom of the page.

But a click cannot be replayed. As soon as an operation must be repeated (one VM per customer, one environment per trainee), you move to the command line and then to infrastructure as code (lesson 3.3, Bicep).

4. Cloud Shell

Cloud Shell is a terminal already authenticated with your account, in the browser:

• two environments to choose from: Bash or PowerShell;
• az CLI, kubectl, git, Terraform and other tools are preinstalled;
• the session is temporary; to keep your files from one session to the next, Cloud Shell offers to attach an Azure file share (billed storage, a few dirhams per month).

It is the fastest way to get started, from any computer, even a PC in a cybercafé where you do not want to install anything.

5. az CLI on your workstation

az CLI installs on Windows, macOS and Linux (the azure-cli package from the Microsoft repositories). Then:

az version                       # installed version
az login                         # opens the browser to sign in
az login --use-device-code       # on a server without a browser: a code to enter elsewhere
az account show --output table   # currently selected subscription
az account list --output table   # all your subscriptions
az account set --subscription "Boutique-Prod"   # switch subscription

The shape of commands

az  <group>   [subgroup]     <action>  --parameters
az  group                    create    --name rg-boutique-prod --location francecentral
az  network   vnet           create    --name vnet-prod ...
az  vm                       list      --output table

az <group> --help lists the possible actions; az find "créer une vm" suggests examples.

Create, list and delete a resource group

# create, with tags to track costs per project
az group create --name rg-boutique-prod --location francecentral \
    --tags env=prod projet=boutique

az group list --output table
az group show --name rg-boutique-prod

# delete ALL the contents of the group (asks for confirmation)
az group delete --name rg-boutique-dev
az group delete --name rg-boutique-dev --yes --no-wait   # no question, in the background

Tags (--tags) are key=value pairs. They change nothing in how things work, but they let you filter cost analysis ("how much does the boutique project cost in production?").

Default values

az configure --defaults group=rg-boutique-prod location=francecentral
az vm list --output table        # now uses rg-boutique-prod
az configure --list-defaults     # see the saved values

Handy, but dangerous in a shared script: make values explicit in production scripts.

Output formats and queries

The --query option filters the result with JMESPath syntax:

# only the name and region of each group
az group list --query "[].{nom:name, region:location}" --output table

# the production groups (tag env=prod)
az group list --query "[?tags.env=='prod'].name" --output tsv

# get the ID of a group into a variable
ID=$(az group show --name rg-boutique-prod --query id --output tsv)
echo "$ID"     # /subscriptions/<id-abonnement>/resourceGroups/rg-boutique-prod

This long identifier (resource ID) comes up everywhere: it identifies a resource unambiguously, and serves as the scope for permissions (lesson 1.2).

6. Locks: avoiding accidental deletion

# forbid deletion (modification is still possible)
az lock create --name ne-pas-supprimer --resource-group rg-boutique-prod \
    --lock-type CanNotDelete

# forbid any modification
az lock create --name lecture-seule --resource-group rg-archives --lock-type ReadOnly

az lock list --resource-group rg-boutique-prod --output table
az lock delete --name ne-pas-supprimer --resource-group rg-boutique-prod

A lock applies even to an Owner of the subscription: the lock must be removed first before deleting. That is exactly the point.

7. Costs from day one

• Create a budget on the subscription (portal: Cost Management → Budgets) with alerts at 50%, 80% and 100%.
• A VM stopped from the operating system is still billed; only a deallocated VM (az vm deallocate) no longer pays for compute (lesson 1.3).
• Disks, public IP addresses and backups are billed even when the VM is off.
• Delete test groups: az group delete is your best cost-saving tool.

Common pitfalls

• Working in the wrong subscription: always run az account show before an important operation, and put az account set at the top of scripts.
• Using the display name of the region ("France Central") instead of the short name francecentral.
• Putting everything in a single resource group: you can no longer delete the test environment without risking production.
• Forgetting tags: six months later, nobody knows which project a 4,000 MAD bill belongs to.

Lab

You prepare the foundation script for Boutique Atlas: selecting the subscription, creating the production resource group in France Central with its tags, default values and a lock. The lab has neither network nor az CLI: you write the script exactly as you would run it in Cloud Shell, then a small file that summarizes the hierarchy of scopes.

cat /root/azure/01-socle.sh      # read the script again
sh -n /root/azure/01-socle.sh    # check the shell syntax without running it

Quiz

1. What is the billing unit in Azure?
2. Can a resource belong to two resource groups?
3. What happens when you delete a resource group?
4. Which az CLI option gives a raw value, easy to put in a shell variable?
5. Can an Owner of the subscription delete a group that has a CanNotDelete lock?

Reference sources: Microsoft Learn (CC BY 4.0) — Azure RBAC, virtual machines and virtual networks documentation. Original MasterLinux text.