SECTION I — Subscriptions
Q87. What is the Difference Between a Microsoft Entra Tenant and an Azure Subscription?
A Microsoft Entra tenant and an Azure subscription are two different boundaries within the Microsoft cloud.
The simplest way to remember the difference is:
Microsoft Entra Tenant → Identity boundary
Azure Subscription → Azure resource and billing boundary
A Microsoft Entra tenant primarily manages identities and directory objects, while an Azure subscription is used to organize and manage Azure resources, billing, quotas, and access to those resources.
Simple Example
Imagine Contoso Corporation has a Microsoft Entra tenant and several Azure subscriptions.
Contoso Corporation
│
▼
Microsoft Entra Tenant
│
┌───────────┼───────────┐
▼ ▼ ▼
Users Groups Applications
│
│
▼
Azure Subscriptions
┌──────────┼──────────┐
▼ ▼ ▼
Production Development Testing
Subscription Subscription Subscription
│ │ │
▼ ▼ ▼
VMs VMs VMs
Storage Storage Storage
Networks Networks Networks
The tenant manages the organization’s identity environment.
The subscriptions contain and organize the organization’s Azure resources.
Q88. What is a Microsoft Entra Tenant?
A Microsoft Entra tenant is a dedicated instance of Microsoft Entra ID for an organization.
It contains identity-related objects such as:
- Users
- Groups
- Devices
- Applications
- Service principals
- Domains
- Directory roles
It provides the organization’s cloud identity and access management environment.
For example:
contoso.comusers and groups can exist in Contoso’s Microsoft Entra tenant.
The tenant has a unique Tenant ID.
Q89. What is an Azure Subscription?
An Azure subscription is a logical boundary used for managing Azure resources and associated billing.
An Azure subscription can contain resources such as:
- Virtual machines
- Storage accounts
- Virtual networks
- Azure SQL databases
- App Services
- Key Vaults
- Other Azure services
A subscription has its own unique Subscription ID.
For example:
Production Subscription
│
├── Virtual Machines
├── Storage Accounts
├── Virtual Networks
└── Azure SQL
Key Differences between Microsoft Entra Tenant vs Azure Subscription
| Microsoft Entra Tenant | Azure Subscription |
|---|---|
| Identity and directory boundary | Azure resource management boundary |
| Contains users, groups, devices, applications, etc. | Contains Azure resources |
| Has a Tenant ID | Has a Subscription ID |
| Manages cloud identities | Manages Azure resources and billing |
| Provides identity and access capabilities | Provides resource deployment and management |
| Can be associated with multiple subscriptions | Is associated with a Microsoft Entra tenant for identity |
Q90. Can a Tenant Have Multiple Subscriptions?
Yes.
This is one of the most important relationships to understand.
An organization can have:
Microsoft Entra Tenant
│
├── Production Subscription
│
├── Development Subscription
│
├── Testing Subscription
│
└── Security Subscription
All of these subscriptions can use identities from the same Microsoft Entra tenant for authentication and authorization.
This allows an organization to separate Azure resources while maintaining a centralized identity environment.
Q91. Why Would an Organization Use Multiple Subscriptions?
There are many reasons.
1. Environment Separation
An organization might separate:
- Production
- Development
- Testing
into different subscriptions.
This can help with management, governance, access control, and billing.
2. Billing Separation
Different subscriptions can help organizations separate costs between:
- Departments
- Projects
- Business units
- Environments
- Customers
3. Access and Governance
Subscriptions provide an important management boundary for Azure resources.
For example:
The Development team may receive access to the Development subscription but not the Production subscription.
Azure RBAC can then be used to control access to resources within the appropriate scope.
4. Resource Limits and Management
Subscriptions also provide boundaries for Azure service limits, quotas, and resource organization.
The exact limits depend on the Azure service and current Microsoft limits.
Q92. Can a User in the Tenant Access Every Subscription?
No.
Simply having a user account in a Microsoft Entra tenant does not automatically give the user access to every Azure subscription associated with that tenant.
The user must have appropriate permissions.
For example:
John
│
▼
Microsoft Entra User
│
├── Subscription A
│ └── Reader
│
└── Subscription B
└── No Access
John may therefore be able to view resources in Subscription A while having no access to Subscription B.
This is an important concept when discussing Azure RBAC.
Q93. What is the Relationship Between Tenant and Subscription?
A useful way to visualize it is:
Microsoft Entra Tenant
│
Identity / Authentication
│
┌────────────┼────────────┐
▼ ▼ ▼
Subscription A Subscription B Subscription C
│ │ │
▼ ▼ ▼
Azure Azure Azure
Resources Resources Resources
The tenant provides the identity foundation.
The subscriptions provide the Azure resource-management boundaries.
Users from the tenant can be granted access to resources in subscriptions through appropriate roles and permissions.
Q94. Tenant ID vs Subscription ID
This is another common interview question.
Tenant ID
Identifies the Microsoft Entra tenant.
Example:
11111111-2222-3333-4444-555555555555
Subscription ID
Identifies an Azure subscription.
Example:
aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee
Both are usually represented as GUIDs, but they identify completely different things.
Tenant ID → Which identity environment?
Subscription ID → Which Azure resource/billing boundary?
Real-World Example
Imagine you work as an Azure Administrator for Contoso.
Your organization has:
Microsoft Entra Tenant
contoso.onmicrosoft.com
and three Azure subscriptions:
Contoso Microsoft Entra Tenant
│
┌──────┼──────┐
▼ ▼ ▼
PROD DEV TEST
│ │ │
▼ ▼ ▼
VMs VMs VMs
SQL SQL SQL
You may have a user account:
admin@contoso.com
That account exists in the Microsoft Entra tenant.
Your administrator account might have:
Owner → Production subscription
Contributor → Development subscription
Reader → Testing subscription
This demonstrates that identity and resource permissions are separate concepts.
Q95. An Important Azure Concept: Management Groups
In larger organizations, you may also encounter Azure Management Groups.
Management Groups provide a higher-level organizational layer for Azure subscriptions.
A simplified hierarchy can look like:
Microsoft Entra Tenant
│
▼
Management Groups
│
┌───────┴────────┐
▼ ▼
Production Non-Production
│ │
▼ ▼
Subscriptions Subscriptions
│ │
▼ ▼
Azure Resources Azure Resources
Management Groups are an Azure governance concept and should not be confused with Microsoft Entra security groups.
We’ll cover Azure RBAC and governance concepts separately later.
⚠️ Common Interview Mistakes
Mistake 1:
“Tenant and subscription are the same.”
❌ Incorrect.
They have different purposes.
Mistake 2:
“Every user in the tenant automatically gets access to Azure.”
❌ Incorrect.
Users need appropriate permissions.
Mistake 3:
“A subscription can contain users and groups.”
Be careful with this statement.
Users and groups are managed in Microsoft Entra ID. Azure subscriptions use those identities when assigning access to Azure resources.
Mistake 4:
“One tenant can have only one subscription.”
❌ Incorrect.
A Microsoft Entra tenant can be associated with multiple Azure subscriptions.
🎯 Interview Tip
If asked:
“What is the difference between a Microsoft Entra tenant and an Azure subscription?”
A strong answer is:
“A Microsoft Entra tenant is primarily an identity and directory boundary that manages identities such as users, groups, applications, and devices. An Azure subscription is primarily a boundary for Azure resource management, billing, quotas, and access control. A single Microsoft Entra tenant can be associated with multiple Azure subscriptions.”
If the interviewer asks:
“Does creating a subscription create a new tenant?”
Answer:
“Not necessarily. An Azure subscription is associated with a Microsoft Entra tenant, and organizations can have multiple subscriptions associated with the same tenant.”
Quick Revision
Remember the three boundaries:
Tenant → Identity
Subscription → Azure resources + billing
Management Group → Organizes subscriptions for governance
The most important interview statement:
One Microsoft Entra tenant can be associated with multiple Azure subscriptions, and users do not automatically have access to every subscription simply because they exist in the tenant.
Q96. Can One Microsoft Entra Tenant Have Multiple Azure Subscriptions?
Yes. A single Microsoft Entra tenant can be associated with multiple Azure subscriptions.
This is a very common architecture in organizations that need to separate Azure resources for different environments, departments, projects, business units, or billing requirements.
Simple example
Suppose Contoso Corporation has one Microsoft Entra tenant:
Contoso Microsoft Entra Tenant
│
┌────────────┼────────────┐
▼ ▼ ▼
Production Development Testing
Subscription Subscription Subscription
│ │ │
▼ ▼ ▼
Azure Azure Azure
Resources Resources Resources
The same Microsoft Entra tenant provides the identity environment used to authenticate users and other identities, while the subscriptions provide separate Azure resource-management boundaries.
Q97. Why would an organization use multiple subscriptions?
There are several common reasons.
1. Separate environments
An organization may maintain separate subscriptions for:
- Production
- Development
- Testing
- Disaster recovery
This helps isolate resources and apply different management and governance requirements.
2. Separate departments or business units
For example:
Microsoft Entra Tenant
│
├── Finance Subscription
├── HR Subscription
├── IT Subscription
└── Marketing Subscription
Different teams can then receive appropriate access to their respective subscriptions.
3. Separate billing
Organizations may use different subscriptions to track costs for:
- Projects
- Departments
- Customers
- Business units
- Environments
This can make cost management and reporting easier.
4. Different access requirements
Different subscriptions can have different administrators and RBAC assignments.
For example:
Entra Tenant
│
┌────────────┴────────────┐
▼ ▼
Production Development
Subscription Subscription
│ │
▼ ▼
Admin Team A Developer Team
A developer might have Contributor access to the Development subscription but no access to Production.
Q98. Does every user in the tenant get access to every subscription?
No.
This is a very important point.
A user existing in the Microsoft Entra tenant does not automatically receive permissions to every Azure subscription associated with that tenant.
Access must be granted through appropriate roles and permissions.
For example:
John
│
▼
Microsoft Entra User
│
├── Production → Reader
│
├── Development → Contributor
│
└── Testing → No Access
This allows organizations to follow the principle of least privilege.
Q99. Can different subscriptions use the same Microsoft Entra users?
Yes.
The same user identity can be assigned different roles in different subscriptions.
For example:
john@contoso.com
could have:
- Reader → Production
- Contributor → Development
- No access → Testing
The user’s identity remains in the same Microsoft Entra tenant, while the user’s permissions can vary at the subscription or resource scope.
Q100. Can a Subscription be associated with another Tenant?
A subscription is associated with a Microsoft Entra tenant for identity and access management, and the subscription’s directory association can be changed under supported scenarios.
However, changing a subscription’s directory association is an administrative operation with important implications and prerequisites.
For interview purposes, the key point to remember is:
A subscription has an associated Microsoft Entra tenant, and Azure RBAC uses identities from that tenant to control access to resources.
⚠️ Common Interview Mistakes
Mistake 1:
“One tenant can have only one Azure subscription.”
❌ Incorrect.
A tenant can be associated with multiple subscriptions.
Mistake 2:
“If a user exists in the tenant, they can access all subscriptions.”
❌ Incorrect.
They need appropriate permissions.
Mistake 3:
“Each subscription requires its own Microsoft Entra tenant.”
❌ Incorrect.
Multiple subscriptions can use the same Microsoft Entra tenant.
🎯 Interview Tip
If asked:
“Can one Microsoft Entra tenant have multiple Azure subscriptions?”
A strong answer is:
“Yes. A single Microsoft Entra tenant can be associated with multiple Azure subscriptions. Organizations commonly use multiple subscriptions to separate production and development environments, departments, projects, billing, governance, and access requirements. Users from the tenant can be assigned different Azure RBAC permissions in each subscription.”
🔗 Related Interview Questions
- Q6. What is a Microsoft Entra ID Tenant?
- Q19. What is the difference between a Microsoft Entra Tenant and an Azure Subscription?
- Q121. What is Azure RBAC?
- Q129. What is the Principle of Least Privilege?
- Q130. Why shouldn’t everyone be given Global Administrator?
Quick Revision
One Microsoft Entra tenant → Multiple Azure subscriptions
And remember:
Being a user in the tenant does not automatically grant access to every subscription.
Access is assigned through appropriate roles and permissions.