Explain the Azure resource hierarchy: tenant, management group, subscription, resource group.
What they are really testing: Whether you understand the organizing structure and that RBAC and policy inherit down it. Getting the levels and inheritance right is fundamental to governance.
A real interview question
Explain the Azure resource hierarchy: tenant, management group, subscription, resource group.
What most people say
drag me
“You have subscriptions and resource groups that contain your resources.”
It names the middle two but misses the tenant (identity boundary) and management groups (where org-wide policy/RBAC are applied), and says nothing about inheritance, which is the governance-relevant part.
The follow-ups they ask next
Why do RBAC assignments and policies applied high in the hierarchy matter?
They inherit downward: a role or policy set at a management group or subscription applies to all child resource groups and resources. You set broad guardrails high and narrow grants low.
What is a subscription a boundary for?
Billing (costs tracked per subscription) and access/isolation. It is a common unit for separating environments (prod vs dev) or teams with hard separation.
What the interviewer is listening for
- Names all four levels correctly
- Knows tenant = identity boundary, subscription = billing/access
- Knows RBAC/policy inherit down
What sinks the answer
- Misses tenant or management groups
- No notion of inheritance
- Confuses subscription with resource group
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“Top down: [tenant (the Entra directory, identity boundary)], [management groups (organize many subscriptions, apply policy/RBAC broadly)], [subscription (billing + access boundary)], [resource group (lifecycle container, a resource is in exactly one)]. The key: [RBAC and policy inherit downward], so [broad guardrails high, narrow grants low].”
Keep going with azure
Foundation
What is Microsoft Entra ID (formerly Azure AD), and how does authentication work in Azure?
Foundation
In Azure, what handles authentication versus authorization?
Junior
How does Azure RBAC work? Explain roles, scopes, and assignments.
Junior
What happens when a user signs in to an Azure/Entra-protected application?
Junior
What is the difference between a service principal and a managed identity, and why prefer managed identities?
Junior
What is Azure Key Vault, and how should an application access a secret from it securely?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free