Microsoft Azure uses more organizational layers than most clouds, and newcomers often confuse them. An account is not a subscription, a subscription is not a tenant, and credits attach to only one of the three. This article walks through each layer, explains how they connect, and shows how the structure maps onto the options listed on the Buy Azure Account page.
The four layers in one picture
Azure separates identity, billing and resources into distinct objects. Reading from the outside in:
- Account (identity). A Microsoft or GitHub identity used to sign in to the Azure portal.
- Tenant (directory). A Microsoft Entra ID directory, formerly Azure Active Directory, that holds users, groups and applications.
- Subscription (billing boundary). The container that resources are billed through. Credits, spending limits and quotas live here.
- Resource groups and resources. Logical folders inside a subscription that hold virtual machines, storage accounts, databases and everything else.
One tenant can hold many subscriptions, and one identity can have access to subscriptions across more than one tenant. The general model is covered in how cloud accounts work; Azure simply makes each layer explicit.
The account: who you are
The account is the sign-in identity. Creating one directly with Microsoft usually requires a phone number, a non-prepaid payment method and a Microsoft or GitHub identity. The account itself does not own resources or carry a bill; it is the key that opens one or more subscriptions.
This is why securing the identity comes first after any change of control. Change the password, enable multifactor authentication and review recovery options before touching anything inside a subscription. The steps in account recovery considerations apply directly.
The tenant: where users and apps live
Every subscription trusts exactly one Entra ID tenant for authentication. The tenant holds user accounts, groups, service principals and role assignments. When you grant a colleague Contributor rights on a subscription, that assignment references an identity in the tenant.
Most account transfers keep the existing directory. Moving a subscription to a different tenant is a more complex process and may not be supported in every case, so clarify the tenant situation before purchase rather than assuming you can change it later. Existing Microsoft 365 or Entra ID integration is another reason organizations care which tenant a subscription belongs to.
The subscription: where the money and the limits are
The subscription is the layer most people mean when they say “Azure account”. It is the billing boundary, and three things that buyers care about are all scoped to it:
- Credits. Promotional or prepaid balances are tied to a subscription and drawn down as resources run.
- Quotas. Core limits for VM families are subscription-specific and region-specific.
- Spending limits. Some subscription types carry a spending limit that halts resource creation when credit is exhausted.
Every listed Azure option is, in practice, a subscription with a particular billing profile. The Azure Pay-As-you-Go Account ($40) is a standard consumption subscription. The credit tiers from the Azure $1k Credit Account ($160) up to the Azure $100k Credit Account ($12500) are subscriptions with a prepaid balance attached. The “With Ai Enable” variants, described in Azure credit accounts with AI services enabled, add readiness for AI services on top of a credit balance.
Resource groups: keeping projects apart
Inside a subscription, resource groups are the working unit. A group holds resources that share a lifecycle, so a whole environment can be deployed, tagged and deleted together. A small team typically uses one subscription with a resource group per environment, such as dev, staging and production.
Larger organizations or agencies often prefer a subscription per client or per major workload, because billing separation at the subscription layer is cleaner than tagging within one subscription. Azure supports both patterns; the choice depends on how strict your billing and access separation needs to be.
A simple starting layout
| Need | Suggested layer |
|---|---|
| Separate dev from production | Resource groups in one subscription |
| Separate one client’s bill from another’s | One subscription per client |
| Give a contractor limited access | Role assignment scoped to a resource group |
| Share sign-in with Microsoft 365 | Same Entra ID tenant |
Why the structure matters when evaluating a listing
Because credits, quotas and spending limits are subscription-scoped, the questions to ask about any listed option are subscription questions: what is the remaining balance, in which regions are VM quotas raised, and is a spending limit active. Ask for portal screenshots that show the subscription, not just the account sign-in.
Also confirm which tenant the subscription trusts and whether the seller can complete a documented billing-ownership change. Microsoft’s terms generally discourage unauthorized transfers, so a transparent, verifiable process protects you as much as it protects the platform. The Azure section of the Cloud FAQ collects the shorter answers.
