Cloud, tenant, resource and subscription: the four questions behind one word

Your marketing team gets an outside agency to build a campaign website. The site works, the campaign runs, and nobody asks another question about it. Until the day someone wants to know where that thing actually lives, and it turns out the site sits in the agency’s own space rather than your organization’s. That gap hides in four words everyone uses interchangeably, as if they all described the same spot: cloud, tenant, resource and subscription. They answer four different questions, and you only notice the difference once something turns out to belong to the wrong organization.

Cloud, tenant, resource and subscription: four questions, not four sizes of the same thing

The cloud is the shelter: a datacenter nearby or far away, where things run without you owning a server. Who owns the space inside it is the tenant, your organization’s own space or your supplier’s. What sits in that space is a resource, one nameable thing with a name and a type, such as a website, a database or a test environment. And how it gets paid for is the subscription, the plan those things hang under and where the bill lands.

The relationship between the four is short enough to keep in your head: one cloud carries a great many tenants, one tenant holds a great many resources, and every resource hangs under exactly one tenant and exactly one subscription. Never two. That is precisely the first exam domain of AZ-900, the Azure Fundamentals exam: what cloud computing is and how the basic terms relate, before you ever reach an architecture decision.

Microsoft itself describes a resource as “a manageable item that’s available through Azure”, with websites, databases and virtual machines as examples. The same source notes that resource groups, subscriptions and management groups are technically resources too, but that detail belongs on the architecture pages, not in the question you are actually dealing with today. For you, a resource is simply the thing you can point at.

The campaign site against the four questions

That campaign site runs in a supplier’s datacenter, so that answers the cloud question. It sits in the agency’s own space, their tenant, not your organization’s. It is one resource, a website with a name and a type. And it hangs under the agency’s subscription, so that is where the invoice lands.

Three of those four answers matched what everyone had assumed. The second did not. And that is exactly how something can work perfectly well and still not belong to you: the site runs, the campaign delivers, the bill gets paid on time, and the thing still sits in a different organization’s space than the one it was built for.

Same site, a different space

Say the agency had built that exact site in your own organization’s space instead. Same datacenter, same name, same type of resource. Exactly one thing changes, and that is the tenant. Everything hanging off that tenant moves with it: the resource itself and the subscription it falls under.

That is where you actually see the relationship between the four words at work. The resource stays identical down to its name, but the space is what makes it belong to someone. Two identical websites can belong to two different organizations without a single line of code being different.

The four questions for anything you use

Of everything your department runs, how many of those things could you say, right now, whose space they sit in? Pick one this week, a scheduling tool or a client portal, and ask whoever manages it the four questions: where does it run, whose space is it in, what exactly is it, and where does the bill land. You do not need to install anything to find out. What those four questions will not tell you is who is allowed to do what inside that space: that is a different question, and it is where the next part of this Azure basics series picks up.

Running into something where nobody on your team has those four answers ready? I’m happy to think it through with you, see trainerbjorn.nl.