Goal: identify the identity directory, subscription and resource-group scope involved in an administrative task. Allow approximately 25 minutes.

Separate identity from resource organisation

Microsoft Entra ID provides an identity directory. An Azure subscription is associated with a directory and acts as an important boundary for resource management and billing. A resource group is a container used to organise related Azure resources within a subscription. A resource group is not another subscription, and creating one does not create a new identity directory.

Think through a small example: your training account signs in through a directory, you select an authorised training subscription and you place a storage account in a lab resource group. The storage account has its own configuration and region. The resource group’s location stores information about the group; it does not force every contained resource into the same region.

Roles need a scope

Azure RBAC connects a principal, a role and a scope. The principal can be a user, group or workload identity. The role describes permitted actions. The scope says where those permissions apply. Access assignments at broader scopes can affect resources below them, so review the effective access rather than assuming that a resource’s immediate role list tells the whole story.

Microsoft Entra directory roles and Azure resource roles have different jobs. Being able to administer directory objects does not automatically imply permission to change every Azure resource. Likewise, resource-management permission and permission to read data inside a service may be separate. Treat a denied operation as a specific principal, action and scope question.

Inspect your active context

If you use Azure CLI, sign in through its official flow, then inspect the selected subscription before any write operation:

az account show --query '{name:name,id:id,tenantId:tenantId}' -o table
az group list --query '[].{name:name,location:location}' -o table

Use an approved training subscription. If the current selection belongs to production or another organisation, stop and select the intended subscription using its ID. Do not paste a login token into the tutor. For troubleshooting, describe the resource type and use redacted error text.

Cost control is part of administration

A resource group itself is a grouping mechanism, but resources placed inside it may generate charges. Promotional credits and free allowances have conditions. A budget notification helps you notice spend; it should not be assumed to stop every resource automatically. Decide what you will create, the allowed spending boundary and the cleanup method before the lab.

Review the Azure Resource Manager overview and the Azure RBAC overview when a concept is unclear.

Exercise: draw three labelled boxes for directory, subscription and resource group. Place your proposed storage account in the right box, then describe one role assignment using principal, role and scope. Ask the tutor to challenge your explanation; verify its correction against Microsoft Learn.