Build, move and delete resource groups, and find your subscription in the hierarchy

short · 25 min · Skills measured 2.1

Before you start — what this lab needs, and what it can cost

This lab runs in your own Azure subscription: an Azure free account or a pay-as-you-go subscription, with your own card on file, so every command acts on something real and billed to you. Charges are possible, so do the clean-up the same day you start; the Azure pricing calculator and each service's pricing page give current rates. It relies on the budget alert you set in lesson 1's lab, which emails you if this subscription starts to cost money. If you skipped that lab, do its first step before this one.

Work with the least privilege the lab allows. Creating resource groups needs the Contributor role on the subscription (or Owner, which includes it); reading management groups needs only read access, and this lab creates no management group. You never need Global Administrator for it. On a brand-new account the first user is the subscription's Owner and the directory's Global Administrator, so if that is the only identity you have, use it carefully and only for the steps written here.

Work in Azure Cloud Shell, so nothing is installed and no credentials are handled: sign in to the Azure portal, select the Cloud Shell icon in the top toolbar and choose Bash. The first time it starts, choose No storage account required (an ephemeral session), so Cloud Shell itself creates nothing billable. An ephemeral session ends after about 20 minutes without input and forgets everything in it; if that happens, open a new session and re-run any line that sets a variable (a line such as NAME=$(az ...)) before you carry on. If you have more than one subscription, first select the one you use for these labs: az account set --subscription 00000000-0000-0000-0000-000000000000, with your own subscription ID in place of the zeros.

Every command uses the region eastus. You may choose a nearer region instead, but then use that same region everywhere this lab says eastus.

This lab ends with a clean-up. Do it the same day: anything left running in your subscription is billed to you.

Task

Show for yourself how the four levels of the Azure hierarchy behave. You will read which subscription and tenant you are working in, create two tagged resource groups, put a virtual network in one of them in a different region from the group itself, move that network into the other group without recreating it, read one of your subscription's quotas, and find your subscription beneath the root management group in the portal. At the end you delete both groups and confirm that deleting a group deletes everything in it. Every resource made here is free to keep for the few minutes the lab takes.

Steps

Find out where you are. Show the subscription Cloud Shell is using, the tenant it trusts, and how many subscriptions your sign-in can see:

az account show --query '{subscription:name, id:id, tenant:tenantId}' -o table
az account list --query 'length(@)' -o tsv

The subscription is both a billing boundary and an access boundary, and it trusts exactly one Microsoft Entra ID tenant: the tenant value. Lesson 6 explains why many organisations keep one subscription per environment. 2. Create two resource groups in eastus, both tagged so you can find them again, and list them by tag:

az group create --name az900-lab06-rg --location eastus --tags project=az900 lesson=06
az group create --name az900-lab06-move-rg --location eastus --tags project=az900 lesson=06
az group list --tag project=az900 --query '[].{name:name, location:location}' -o table

Both rows show eastus. A resource group's location is only where its metadata lives, and a group cannot be renamed once it exists. 3. Prove that a group's location does not restrict its contents. Create an empty virtual network in a different region, westus, inside the eastus group, then list the group's resources:

az network vnet create --resource-group az900-lab06-rg --name az900-lab06-vnet --location westus --address-prefixes 10.6.0.0/16
az resource list --resource-group az900-lab06-rg --query '[].{name:name, type:type, location:location}' -o table

The one row is az900-lab06-vnet, type Microsoft.Network/virtualNetworks, location westus. An empty virtual network costs nothing. If you chose a different lab region, pick any other region here. 4. Move the network to the second group. It is not recreated: it keeps its settings and its region, and only its resource ID changes:

VNET_ID=$(az network vnet show --resource-group az900-lab06-rg --name az900-lab06-vnet --query id -o tsv)
az resource move --destination-group az900-lab06-move-rg --ids "$VNET_ID"

The move takes a minute or two, and both groups refuse other changes while it runs. Every resource belongs to exactly one group, so after the move az900-lab06-rg is empty. 5. Read one of the limits that a subscription sets. Virtual networks are counted per subscription and region:

az network list-usages --location eastus --query '[?name.value==`"VirtualNetworks"`].{used:currentValue, limit:limit}' -o table

used is how many virtual networks this subscription has in eastus, and limit is the ceiling. When a workload reaches such a ceiling, a further subscription is one way past it. 6. See the level above your subscription in the portal. In the search bar at the top of the Azure portal, type Management groups and open it. If it lists Tenant Root Group, open it: your subscription appears beneath it, because every subscription in a tenant folds up to that one root. If the page instead offers to start using management groups, leave it as it is; this lab creates no management group, and the hierarchy still exists above your subscription. Then open Subscriptions, open your subscription, and read its Parent management group on the Overview page if it is shown. 7. Match each requirement to the level that meets it, then check your answers in the Notes: (a) finance wants a separate invoice for the marketing department; (b) one allowed-regions rule must cover forty subscriptions, including ones created next year; (c) a test environment's VMs, disks and network must be removable in one action; (d) auditors need read access to every resource the company has; (e) the company wants Corporate, Production and Development groupings, nested. Write your answers before you look.

Verify

Read where the network ended up, that the first group is now empty, and that the group's own location never changed.

az network vnet show --resource-group az900-lab06-move-rg --name az900-lab06-vnet --query location -o tsv

Expected output: westus.

az resource list --resource-group az900-lab06-rg --query 'length(@)' -o tsv

Expected output: 0.

az group show --name az900-lab06-rg --query location -o tsv

Expected output: eastus.

Cost and clean-up

Resource groups, tags and an empty virtual network are not charged, and nothing here is left running. Charges are possible only if you add something else to these groups, so do the clean-up straight away.

Created by this lab: the resource group az900-lab06-rg; the resource group az900-lab06-move-rg; the virtual network az900-lab06-vnet, now in az900-lab06-move-rg.

Delete the group that holds the network. Deleting a group deletes everything in it, so az900-lab06-vnet goes with az900-lab06-move-rg; it is not moved anywhere or left behind:

az group delete --name az900-lab06-move-rg --yes

Delete the now-empty first group:

az group delete --name az900-lab06-rg --yes

Each delete takes a minute or so and returns when it has finished.

Check it is gone

az group exists --name az900-lab06-rg
az group exists --name az900-lab06-move-rg

Expected output: false, printed twice.

Notes

Answers to step 7: (a) a subscription, because billing is reported per subscription; (b) a management group above all forty, so new subscriptions placed under it inherit the rule; (c) a resource group, since deleting it deletes everything in it; (d) a role assigned at the root management group, which every subscription inherits; (e) nested management groups, because resource groups cannot be nested.

When you create the first virtual network in a region, Azure may also create a resource group named NetworkWatcherRG holding a Network Watcher for that region. It is a shared, subscription-wide monitoring setting rather than part of this lab, other networks you make later use it too, and simply having it enabled is not charged (its optional features, such as flow logs, are charged when you turn them on). This lab leaves it in place.

This is an independent study companion for the Microsoft Azure Fundamentals (AZ-900) exam and is not produced by or endorsed by Microsoft. Microsoft, Azure and Microsoft Entra are trademarks of the Microsoft group of companies.

This is an independent study companion for Microsoft Azure Fundamentals AZ-900 and is not produced by or endorsed by CompTIA.