Regions and Subscriptions

Azure Basics · Governance – Regions, Subscriptions, Policy and RBAC · Lesson 1 of 5

A region is a set of datacenters to place resources near users and within data rules; a subscription is the billing and access-management boundary for resources.

Regions

A region is a set of datacenters in one geographic area (Azure has more than 60). Choose by proximity to users (latency), service availability in that region, data residency (where data may be stored) and price.
Many regions have a region pair (for example Southeast Asia ↔ East Asia): platform updates roll out to one region of the pair at a time, and recovery is prioritised during large outages.
Some services are global (Entra ID, Front Door, Traffic Manager) — not tied to a region.

Subscriptions

A subscription is the logical unit for using Azure services: a billing boundary and an access-management boundary for resources. It trusts one Entra ID tenant; only identities of that tenant can create/manage it.

flowchart TB
  T["Tenant example.com"] --> S1["Subscription sub-devops-lab<br/>(Pay-As-You-Go)"]
  T --> S2["Subscription sub-prod<br/>(Enterprise Agreement)"]
  S1 --> R1["rg-devops-lab<br/>southeastasia"]
  S2 --> R2["rg-web-prod<br/>eastasia"]

Type	Behaviour
Free	$200 credit for the first 30 days + some services free for 12 months
Pay-As-You-Go	Pay monthly for what you use, by credit card
CSP	Bought through a partner (Cloud Solution Provider)
Enterprise Agreement	One agreement for the whole organisation, upfront commitment, discounted prices
Azure for Students	$100 credit for 12 months, student verification needed

Credit amounts may change over time. Trap: a subscription is a billing boundary; the identity boundary is the tenant.

Command	Meaning
`az account list -o table`	Subscriptions you can see
`az account set --subscription sub-devops-lab`	Pick the working subscription
`az account list-locations -o table`	List the regions

Inside a region: availability zones

Many regions have three or more availability zones, physically separate datacenters with their own power, cooling, and network. Zonal resources are pinned to one zone (a VM in zone 1); zone-redundant resources spread across zones automatically (ZRS storage, zone-redundant Standard Load Balancer). Spreading across zones protects against one datacenter failing; using a second region protects against a regional outage.

Regions are grouped into geographies that respect data residency laws. Separate sovereign clouds, such as Azure Government and Azure operated by 21Vianet in China, have their own portals and endpoints.

Resource groups

A resource group is a container for resources that share a lifecycle: deploy, monitor, and delete them together. Every resource lives in exactly one group, groups cannot be nested, and a group's own location only stores its metadata; the resources inside can be in other regions. Deleting a group deletes everything in it.

Quotas and moves

Each subscription has quotas, such as total vCPUs per region. az vm list-usage --location southeastasia -o table shows usage against limits, and you can request an increase in the portal. Many resources can be moved between resource groups or subscriptions with az resource move, although some types cannot move and the move briefly locks both groups.

Organising subscriptions

A common design gives each environment or workload its own subscription (for example sub-dev, sub-prod) under management groups, so access, policy, and cost stay separate. Microsoft's Azure landing zone guidance describes this layout in detail. Pair it with a naming convention such as rg-<app>-<env>-<region> so names explain themselves.