Azure account types explained: tenants, subscriptions and where the credit sits

Azure keeps identity, billing and resources in separate layers, and almost every “why can’t I see this” question comes down to looking at the wrong layer. It is worth ten minutes to get the model straight.

The four layers, from the outside in

• Tenant. A Microsoft Entra ID directory. This is the identity boundary: users, groups, service principals and the sign in domain. A tenant is not billed for anything itself.
• Management group. An optional grouping of subscriptions, used to apply policy and access control across several at once. Larger organisations use these; a single project does not need them.
• Subscription. The billing and quota container. Costs accumulate here, quotas apply here, and this is where credits are attached.
• Resource group. A folder inside a subscription that holds resources with a shared lifecycle. Deleting the group deletes everything in it, which is either extremely convenient or a lesson.

The practical version: identity is tenant level, money and capacity are subscription level, and organisation is resource group level.

The offer types you will meet

Free account. Comes with a credit balance valid for a fixed window from activation, plus a set of services that stay free for twelve months and a smaller set that are always free within monthly limits. The credit is the headline; the twelve month allowances are the part people forget to use.

Pay as you go. A standard subscription under the Microsoft Customer Agreement, billed monthly on metered usage. No commitment, no minimum. This is what a free account becomes when you upgrade it.

Enterprise Agreement. A negotiated commitment with prepaid balance and discounted rates. Relevant if your organisation has one; not something you sign up for casually.

Cloud Solution Provider. A subscription bought through a Microsoft partner who handles the billing relationship. Common with managed service providers.

Sponsorship and programme credits. Startup programmes, education programmes and event grants issue credits into an existing subscription. Each has its own expiry and its own exclusions.

Quotas are per subscription, per region, per family

This catches people who assume a paid subscription has no limits. Azure enforces a vCPU quota per VM family, per region, inside each subscription. A new subscription may have a low total regional limit and a much lower one on any particular series, especially the GPU families, which frequently start at zero.

You can see the current values under Subscriptions, then Usage and quotas, filtered by region and provider. Increases are requested through a support ticket, and as with other clouds, requests from subscriptions with billing history clear faster.

The lesson is the same one that applies to AWS: capacity is a property of the subscription, not of the platform. If you need a particular series in a particular region, check before you plan around it.

Where the cost comes from

Azure bills through meters. Every resource emits one or more, and the invoice is the sum of meter readings multiplied by their rates. That structure matters because a single virtual machine typically emits several meters: compute hours, managed disk capacity, disk operations, a public IP address, and bandwidth out.

Cost Management gives you the breakdown, and it is worth opening in the first week rather than the first surprise. Tag resources consistently from the start; retro fitting tags across a live subscription is tedious work.

The pricing mechanisms themselves, including reservations and the savings plan, are covered in how Azure pricing works.

Choosing between them

• Evaluating a service or studying. A credit backed trial subscription is the right shape. Use the twelve month allowances rather than burning credit on things that are already free.
• Running something small and continuous. Pay as you go, sized conservatively, with a budget alert.
• A fixed budget project. A larger credit balance moves the cost question, but check the expiry window against your project timeline. Credit that expires mid project is worse than no credit at all for planning purposes.
• Anything needing specific VM series. Confirm the quota for that series in that region first.

Before you deploy

Set up multi factor authentication on the account, create a dedicated resource group per environment, note the region and check the quotas for the series you intend to use. The series naming is decoded in the Azure VM series guide.

If you are comparing Azure against the alternatives rather than setting it up, AWS vs Azure and Azure vs Google Cloud put the differences side by side with current catalogue pricing.