Last updated: May 2026

Azure Fundamentals Beginner AZ-900 ⏱ 12 min read

Azure Resource Groups

Every single resource you create in Azure — every VM, storage account, database, network — must live inside a Resource Group. Resource Groups are the fundamental unit of organisation in Azure. Get them right and your Azure environment is clean, manageable, and cost-transparent. Get them wrong and you'll be hunting for resources across a chaotic subscription. This page covers everything you need to know.

What you'll learn What Resource Groups are · Key rules and constraints · How to organise resources into groups · Resource Group region vs resource region · Tags for cost tracking · Access control at the group level · Deleting resource groups · ARM templates and Resource Groups · Best practices

Table of Contents

What Are Resource Groups?
Key Rules & Constraints
How to Organise Resources
Resource Group Region vs Resource Region
Tags — Metadata for Cost Tracking
Access Control on Resource Groups
Resource Group Lifecycle
Creating Resource Groups
Best Practices
Practice Questions

What Are Resource Groups?

A Resource Group is a logical container that holds related Azure resources. Think of it as a folder — you put related files (resources) in the same folder (Resource Group) so you can manage them together.

Every Azure resource — without exception — must belong to exactly one Resource Group. You cannot create a VM, storage account, or any other resource without first assigning it to a group.

ℹ️

Why Resource Groups Exist Before Resource Groups, managing Azure was chaotic — resources were scattered with no way to see what belonged together. Resource Groups were introduced so you could manage, monitor, tag, secure, and delete related resources as a single unit.

Key Rules & Constraints

Understanding these rules is critical — they come up on the AZ-900 exam:

Rule	Detail
One group per resource	Every resource belongs to exactly one Resource Group
Can't be nested	Resource Groups cannot contain other Resource Groups
Resources can span regions	Resources in a group don't have to be in the same region
Resources can be moved	Most (not all) resources can be moved between Resource Groups
Deletion cascades	Deleting a Resource Group deletes all resources inside it
No cost for the group itself	Resource Groups are free — you only pay for the resources inside

⚠️

Deletion Is Irreversible When you delete a Resource Group, all resources inside are permanently deleted with no confirmation second chance. Always double-check before deleting. Use Azure locks to protect critical resource groups from accidental deletion.

How to Organise Resources

There's no single right answer — the best organisation depends on your team and workloads. Here are the most common patterns:

By Environment (Most Common)

Separate Resource Groups for dev, test/staging, and production. This is the most popular pattern because it keeps environments clean and makes it easy to delete a whole dev environment at once.

rg-webapp-dev
rg-webapp-staging
rg-webapp-prod

By Application

All resources for a specific application in one group, regardless of environment. Works well for smaller teams with one or two apps.

rg-webapp
rg-api-service
rg-data-pipeline

By Department / Team

Organise by the team that owns the resources. Makes cost allocation and access management simple.

rg-engineering
rg-marketing
rg-finance

By Region

Separate groups for different deployment regions. Useful for geo-distributed applications.

rg-webapp-centralindia
rg-webapp-southindia

💡

Recommended Naming Convention Use: rg-[workload]-[environment]-[region]
Examples: rg-ecommerce-prod-centralindia, rg-api-dev-eastus
Consistent naming makes filtering and searching much faster as your subscription grows.

Resource Group Region vs Resource Region

When you create a Resource Group, you choose a region for it. This can be confusing — here's what it actually means:

The Resource Group's region is where the Resource Group's metadata is stored — not where the resources live. The actual resources inside can be in any region.

ℹ️

Example You create a Resource Group in Central India. Inside it, you put a VM in East US, a storage account in West Europe, and a database in Central India. All three resources are in the same Resource Group, even though they span three different regions. Only the group's metadata is in Central India.

⚠️

Why This Matters If the Resource Group's metadata region is unavailable (rare but possible), you may temporarily lose the ability to manage those resources — even if the resources themselves are healthy in another region. For critical workloads, choose a stable, well-supported region for your Resource Group.

Tags — Metadata for Cost Tracking

Tags are name-value pairs you attach to Resource Groups (and individual resources) to add metadata. Tags don't affect functionality — they help you organise, filter, and track costs.

Tag Name	Tag Value	Purpose
Environment	Production	Filter prod vs dev resources
Department	Engineering	Cost allocation by team
Project	RedKiteCloud	Track spending per project
Owner	john@company.com	Know who to contact
CostCenter	CC-1042	Map to finance cost centre

Azure CLI Create a Resource Group with tags

az group create \
  --name rg-webapp-prod \
  --location centralindia \
  --tags Environment=Production Department=Engineering Project=WebApp

💡

Tags + Cost Management In Azure Cost Management, you can filter your cost breakdown by tag. This means you can see exactly how much the "Engineering" department spent, or how much the "Production" environment costs — without needing separate subscriptions.

Access Control on Resource Groups

Azure uses Role-Based Access Control (RBAC) to manage who can do what. You can assign roles at the Resource Group level — and those permissions automatically apply to all resources inside the group.

Role	Can Do
Owner	Full access — can manage resources and assign roles to others
Contributor	Can create and manage resources — cannot assign roles
Reader	Can view resources — cannot make any changes
User Access Administrator	Can manage user access — cannot manage resources

💡

Practical Example Give your dev team Contributor access on rg-webapp-dev so they can create and manage dev resources freely. Give them Reader access on rg-webapp-prod so they can view production but never accidentally change it.

Resource Group Lifecycle

One of the most powerful features of Resource Groups is lifecycle management. When you're done with a project, environment, or experiment — delete the Resource Group and everything inside is cleaned up in one action.

Azure CLI Delete a resource group and all its resources

# Delete entire resource group (and everything inside)
az group delete --name rg-webapp-dev --yes --no-wait

ℹ️

Azure Resource Locks To protect critical resources from accidental deletion, apply a lock to the Resource Group. A CanNotDelete lock prevents deletion. A ReadOnly lock prevents any changes. Locks can be set in the portal under Resource Group → Locks.

Creating Resource Groups

Azure CLI Create a resource group

az group create \
  --name rg-myproject-prod \
  --location centralindia

PowerShell Create a resource group

New-AzResourceGroup -Name "rg-myproject-prod" -Location "centralindia"

Best Practices

One environment per group — Never mix dev and prod resources in the same group
Consistent naming — Use rg-[workload]-[env]-[region] across your organisation
Always use tags — At minimum: Environment, Owner, and Project
Apply locks to production groups — CanNotDelete lock on all prod resource groups
Group by lifecycle — Resources deleted together should live together
Keep shared services separate — Networking, DNS, and shared VMs often go in a dedicated rg-shared-infra group

💡

AZ-900 Exam Tip Key facts: every resource belongs to exactly one RG · RGs cannot be nested · deleting an RG deletes all resources inside · resources in a group can span regions · you can apply RBAC and tags at the RG level.

📝 Practice Questions

Click an option to check your answer. AZ-900 style questions.

Q1. What is an Azure Resource Group?

A A billing unit that determines how Azure charges you

B A physical data centre location for your resources

C A logical container for grouping related Azure resources

D A container that can hold other Resource Groups

Q2. What happens when you delete a Resource Group in Azure?

A Only the container is deleted; resources inside are moved to a default group

B The Resource Group and all resources inside it are permanently deleted

C Resources are moved to an Azure recycle bin for 30 days

D Resources are archived automatically before deletion

Q3. Can resources in the same Resource Group be in different Azure regions?

A Yes — resources in the same group can be in different regions

B No — all resources must be in the same region as the Resource Group

C No — resources must be in the same country as the Resource Group

D Only if they are in fewer than 3 different regions

Q4. What are Azure tags used for on Resource Groups?

A To improve the performance of resources in the group

B To control who has access to the resources

C To add metadata for organisation, cost tracking, and filtering

D To specify which Azure region resources should run in

Q5. A company wants to give its development team the ability to create and manage resources in the dev environment, but only view production resources. How should they configure this?

A Assign the dev team Owner role on both dev and prod resource groups

B Assign Contributor on the dev Resource Group and Reader on the prod Resource Group

C Assign Reader role on both dev and prod resource groups

D Assign a single custom role that covers both groups simultaneously

← Previous Azure Pricing & Free Tier Next → Azure Subscriptions

Comments

Disclaimer: RedKite Cloud is an independent educational resource and is not affiliated with, endorsed by, or officially connected to Microsoft Corporation. All product names, logos, and trademarks are property of their respective owners. Content is written independently for educational purposes only.