> For the complete documentation index, see [llms.txt](https://www.techwithtyler.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.techwithtyler.dev/cloud-security/azure/azure-overview.md).

# Azure Overview

{% hint style="info" %}
This page provides a high-level overview of core Azure services from a security perspective. These services are key to building comprehensive security coverage across your environment, but this list is not exhaustive.
{% endhint %}

## Organization & Account Structure

```
Entra ID Tenant
└── Management Groups (optional)
     └── Subscription(s)
          └── Resource Group(s)
               └── Resource(s)
```

Azure organizes resources through a hierarchy rooted at an Entra ID Tenant, Microsoft's cloud identity platform previously known as Azure Active Directory (Azure AD), automatically created when an organization signs up for Azure or Microsoft 365. The Tenant serves as the identity and security boundary for the organization, managing identities such as users, devices, and applications, but does not directly contain Azure resources. Subscriptions can be placed directly under the Tenant root or optionally organized into Management Groups. Management Groups provide logical grouping of subscriptions by environment, department, region, or other criteria, and can be leveraged for Azure Policy as a preventive control, RBAC assignments for access management at scale, and more.

Subscriptions are the primary unit of security isolation in Azure, with their own RBAC scope, resource limits, and billing boundary. Each subscription must be linked to exactly one Entra ID tenant. Within a subscription, Resource Groups serve as mandatory containers for all resources and provide a secondary scoping layer for RBAC and policy assignments. Deleting a Resource Group removes all resources within it, making resource group-level RBAC a critical control surface. This makes the subscription the recommended blast radius boundary, where workloads, environments (dev/prod), and security functions (logging, auditing) are separated into dedicated subscriptions.

The Global Administrator role in Entra ID is the highest-privilege identity in an Azure tenant. A Global Administrator can elevate their own access to User Access Administrator across all Azure subscriptions in the tenant, meaning a compromise of this role is effectively a compromise of the entire organization. [Microsoft recommends](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access) treating Global Administrator accounts as break-glass accounts, using dedicated hardened accounts accessed only in emergencies, and distributing day-to-day management through scoped RBAC role assignments and Azure Policy at the management group or subscription level.

## Policy & Governance

## Logging & Monitoring

## Identity & Access Management

## Security & Threat Detection

## Network Security