Governance, Cost Management, and Subscription Organization
Organizational hierarchy
Management groups organize subscriptions into a hierarchy for policy and access inheritance. Subscriptions are units of billing, quota, and scale. Resource groups group resources with a common lifecycle. Tags add metadata for cost allocation and automation, but tags are not inherited by default; Azure Policy can enforce or append them.
Governance controls
Azure Policy provides guardrails such as allowed regions, required tags, and denied resource types. Resource locks prevent deletion or modification. RBAC controls who can act. Azure Blueprints and landing-zone accelerators package governance, but policy and RBAC remain the core controls. Naming standards and quotas prevent sprawl.
Cost management
Azure Cost Management provides cost analysis, budgets, alerts, and exports. Reservations and savings plans reduce cost for predictable usage; Azure Hybrid Benefit applies existing licenses. Advisor offers cost, security, and reliability recommendations. Budgets send alerts but do not stop spending automatically. Reservations have scope and term commitments.
Traps
Common traps include assuming tags are inherited, treating budgets as hard spending caps, confusing locks with RBAC, and assuming a management group is a billing boundary. Also distinguish cost alerts from quotas, which can block deployments but are not billing controls.
Worked example
A company wants every subscription to require a CostCenter tag and block resources outside Europe. Apply an Azure Policy at the management group with a deny effect for disallowed regions and an append or modify effect for the tag. Use a budget alert for visibility; do not rely on it to stop deployments.
Rule of thumb
Use management groups for structure, policy for guardrails, RBAC for access, tags for allocation, and budgets for awareness.