Task 02: Create Subscriptions

DOCUMENT CATEGORY: Runbook
SCOPE: Full CAF/WAF subscription provisioning
PURPOSE: Create and associate dedicated subscriptions with management groups
MASTER REFERENCE: Create Azure subscriptions programmatically

Status: Active

---

Overview

Provision dedicated Azure subscriptions and associate each with its corresponding management group. The full CAF/WAF deployment uses separate subscriptions for platform services and landing zones, providing maximum billing isolation, RBAC boundaries, and governance flexibility.

How You Create Subscriptions

How you create subscriptions depends on your organization's billing arrangement:

Billing Type	Creation Method	Programmatic Support
Enterprise Agreement (EA)	EA Portal, Azure CLI, or REST API	✅ Full — az account create with enrollment account
Microsoft Customer Agreement (MCA)	Azure Portal, Azure CLI, or REST API	✅ Full — az account create with billing profile + invoice section
Pay-As-You-Go / MOSP	Azure Portal only	❌ Manual only — use the portal

Programmatic Subscription Creation

If you have an EA or MCA, you can create subscriptions programmatically using az account create or New-AzSubscriptionAlias. This is the recommended approach for the full deployment model where you need 5+ subscriptions. See the Execution Options below.

What This Accomplishes

• Billing isolation — separate cost tracking per platform function and landing zone
• Access control — subscription-level RBAC boundaries
• Resource organization — dedicated containers aligned with management group hierarchy
• Governance scope — policy and compliance boundaries per subscription

Prerequisites

Prerequisite	Detail
Management Groups	Full hierarchy deployed (Task 01)
Billing Access	EA enrollment account owner, MCA billing profile owner, or Azure Portal access to create subscriptions
Subscription Quota	Available subscription quota in your tenant (default: 5000 per EA, varies by agreement)
Permissions	Management Group Contributor on target MGs (to associate subscriptions after creation)

Subscription Architecture

Each leaf-level management group hosts a dedicated subscription:

Subscription Mapping (IIC Example)

Management Group	Subscription Name	Config Path	Purpose
cmp-platform-identity-iic	iic-platform-identity-001	azure.subscriptions.platform_identity.name	Entra ID Connect, identity services
cmp-platform-management-iic	iic-platform-management-001	azure.subscriptions.platform_management.name	Azure Monitor, Log Analytics, Automation
cmp-platform-connectivity-iic	iic-platform-connectivity-001	azure.subscriptions.platform_connectivity.name	Hub VNet, VPN, ExpressRoute
cmp-lz-corp-iic	iic-lz-azurelocal-corp-001	azure.subscriptions.lz_corp.name	Azure Local clusters (corporate)
cmp-lz-online-iic	iic-lz-azurelocal-online-001	azure.subscriptions.lz_online.name	Internet-facing workloads

Target Structure

cmp-iic-root                              ← organization root MG
├── cmp-platform-iic
│   ├── cmp-platform-identity-iic
│   │   └── iic-platform-identity-001     ← subscription
│   ├── cmp-platform-management-iic
│   │   └── iic-platform-management-001   ← subscription
│   └── cmp-platform-connectivity-iic
│       └── iic-platform-connectivity-001 ← subscription
├── cmp-landing-zones-iic
│   ├── cmp-lz-corp-iic
│   │   └── iic-lz-azurelocal-corp-001    ← subscription
│   └── cmp-lz-online-iic
│       └── iic-lz-azurelocal-online-001  ← subscription
├── cmp-sandbox-iic (no subscription yet)
└── cmp-decommissioned-iic (no subscription yet)

Variables from variables.yml

Variable	Config Path	Example (IIC)
Platform Identity Sub	azure.subscriptions.platform_identity.name	iic-platform-identity-001
Platform Management Sub	azure.subscriptions.platform_management.name	iic-platform-management-001
Platform Connectivity Sub	azure.subscriptions.platform_connectivity.name	iic-platform-connectivity-001
Corp Landing Zone Sub	azure.subscriptions.lz_corp.name	iic-lz-azurelocal-corp-001
Online Landing Zone Sub	azure.subscriptions.lz_online.name	iic-lz-azurelocal-online-001

---

Execution Options

Azure Portal

Azure Portal

When to use: Pay-As-You-Go billing, or you prefer the visual interface

Procedure

1. Navigate to Subscriptions:

   • In Azure Portal, search for Subscriptions
   • Click + Add

2. Create each subscription from the mapping table above:

   • Subscription name: Enter the name from the mapping table (e.g., iic-platform-identity-001)
   • Billing: Select your billing account / enrollment
   • Management group: Select the corresponding management group from the mapping table
   • Click Create

3. Verify each subscription appears under the correct management group in Management groups view

Creating Multiple Subscriptions

Work through the mapping table top-to-bottom, creating all Platform subscriptions first, then Landing Zone subscriptions. The Azure Portal allows you to set the management group at creation time, saving the manual association step.

Validation

• All 5 subscriptions created with names matching variables.yml
• Each subscription is under the correct management group
• You have Owner access to all subscriptions

EA — Azure CLI

Enterprise Agreement — Azure CLI

When to use: Your organization has an EA and you want to automate subscription creation

Prerequisites

• Enrollment Account ID — your EA enrollment account (find it with az billing enrollment-account list)
• Azure CLI 2.50+ with the account extension

Find Your Enrollment Account

# List enrollment accounts you have access to
az billing enrollment-account list --query "[].{name:name, principalName:principalName}" -o table

Save the name value (a GUID) — this is your enrollment account ID.

Create Subscriptions

# ── Platform Subscriptions ───────────────────────────────────────────────────

# Identity
az account create \
  --enrollment-account-name "<enrollment-account-id>" \
  --display-name "iic-platform-identity-001" \
  --offer-type "MS-AZR-0017P"

# Management
az account create \
  --enrollment-account-name "<enrollment-account-id>" \
  --display-name "iic-platform-management-001" \
  --offer-type "MS-AZR-0017P"

# Connectivity
az account create \
  --enrollment-account-name "<enrollment-account-id>" \
  --display-name "iic-platform-connectivity-001" \
  --offer-type "MS-AZR-0017P"

# ── Landing Zone Subscriptions ───────────────────────────────────────────────

# Corp (Azure Local)
az account create \
  --enrollment-account-name "<enrollment-account-id>" \
  --display-name "iic-lz-azurelocal-corp-001" \
  --offer-type "MS-AZR-0017P"

# Online
az account create \
  --enrollment-account-name "<enrollment-account-id>" \
  --display-name "iic-lz-azurelocal-online-001" \
  --offer-type "MS-AZR-0017P"

Offer Types

• MS-AZR-0017P = EA Enterprise (most common)
• MS-AZR-0148P = EA Dev/Test (lower rates, no SLA)

Use Dev/Test for sandbox subscriptions if your EA supports it.

Associate with Management Groups

After creation, move each subscription to its target management group:

# Get the subscription IDs (they're returned from az account create, or query them)
IDENTITY_SUB=$(az account list --query "[?name=='iic-platform-identity-001'].id" -o tsv)
MANAGEMENT_SUB=$(az account list --query "[?name=='iic-platform-management-001'].id" -o tsv)
CONNECTIVITY_SUB=$(az account list --query "[?name=='iic-platform-connectivity-001'].id" -o tsv)
CORP_SUB=$(az account list --query "[?name=='iic-lz-azurelocal-corp-001'].id" -o tsv)
ONLINE_SUB=$(az account list --query "[?name=='iic-lz-azurelocal-online-001'].id" -o tsv)

# Move to management groups
az account management-group subscription add --name "cmp-platform-identity-iic" --subscription $IDENTITY_SUB
az account management-group subscription add --name "cmp-platform-management-iic" --subscription $MANAGEMENT_SUB
az account management-group subscription add --name "cmp-platform-connectivity-iic" --subscription $CONNECTIVITY_SUB
az account management-group subscription add --name "cmp-lz-corp-iic" --subscription $CORP_SUB
az account management-group subscription add --name "cmp-lz-online-iic" --subscription $ONLINE_SUB

MCA — Azure CLI

Microsoft Customer Agreement — Azure CLI

When to use: Your organization has an MCA and you want to automate subscription creation

Prerequisites

• Billing account name, billing profile name, and invoice section name from your MCA

Find Your Billing Info

# List billing accounts
az billing account list --query "[].{name:name, displayName:displayName}" -o table

# List billing profiles (use your billing account name)
az billing profile list --account-name "<billing-account-name>" \
  --query "[].{name:name, displayName:displayName}" -o table

# List invoice sections (use your billing profile name)
az billing invoice section list \
  --account-name "<billing-account-name>" \
  --profile-name "<billing-profile-name>" \
  --query "[].{name:name, displayName:displayName}" -o table

Create Subscriptions

# Create each subscription under the MCA billing scope
az account create \
  --billing-account-name "<billing-account-name>" \
  --billing-profile-name "<billing-profile-name>" \
  --invoice-section-name "<invoice-section-name>" \
  --display-name "iic-platform-identity-001" \
  --sku-id "0001"

# Repeat for each subscription in the mapping table, changing --display-name

Associate with Management Groups

Use the same az account management-group subscription add commands shown in the EA tab above.

PowerShell (EA)

PowerShell — Enterprise Agreement

When to use: PowerShell-based automation for EA subscriptions

Code

# ============================================================================
# Script: Deploy-Subscriptions.ps1
# Prerequisites: Az.Subscription module, EA enrollment account access
# ============================================================================

#Requires -Modules Az.Subscription, Az.Resources

# Load configuration
$config = Get-Content "./config/variables.yml" | ConvertFrom-Yaml
$subs = $config.azure.subscriptions
$mg = $config.azure.management_groups

# Get enrollment account
$enrollmentAccount = Get-AzEnrollmentAccount | Select-Object -First 1

if (-not $enrollmentAccount) {
    Write-Error "No enrollment account found. Verify EA access."
    return
}

Write-Host "Using enrollment account: $($enrollmentAccount.PrincipalName)" -ForegroundColor Cyan

# Define subscription-to-MG mapping
$subscriptionPlan = @(
    @{ Name = $subs.platform_identity.name;    MG = $mg.platform_identity.name },
    @{ Name = $subs.platform_management.name;  MG = $mg.platform_management.name },
    @{ Name = $subs.platform_connectivity.name; MG = $mg.platform_connectivity.name },
    @{ Name = $subs.lz_corp.name;              MG = $mg.lz_corp.name },
    @{ Name = $subs.lz_online.name;            MG = $mg.lz_online.name }
)

foreach ($sub in $subscriptionPlan) {
    Write-Host "Creating subscription: $($sub.Name) ..." -ForegroundColor Cyan

    # Create subscription
    $result = New-AzSubscriptionAlias `
        -AliasName $sub.Name `
        -SubscriptionName $sub.Name `
        -BillingScope $enrollmentAccount.ObjectId `
        -Workload "Production"

    $subId = $result.Properties.SubscriptionId
    Write-Host "  Created: $subId" -ForegroundColor Gray

    # Associate with management group
    New-AzManagementGroupSubscription `
        -GroupId $sub.MG `
        -SubscriptionId $subId

    Write-Host "  Associated with MG: $($sub.MG)" -ForegroundColor Gray
}

Write-Host "All subscriptions created and associated successfully" -ForegroundColor Green

---

Using Existing Subscriptions

If your organization already has subscriptions provisioned (e.g., through a volume licensing agreement or prior setup), you can skip creation and just associate them with the correct management groups.

Move Existing Subscriptions

# Move a subscription to a management group
az account management-group subscription add \
  --name "<management-group-id>" \
  --subscription "<subscription-id-or-name>"

# PowerShell equivalent
New-AzManagementGroupSubscription `
    -GroupId "<management-group-id>" `
    -SubscriptionId "<subscription-id>"

Subscription Move Impact

Moving a subscription to a different management group changes which Azure Policies and RBAC role assignments it inherits. Review inherited policies before moving production subscriptions.

---

Validation

• All subscriptions exist with names from variables.yml
• Each subscription is associated with the correct management group per the mapping table
• Subscriptions are visible under their respective MGs in the Azure Portal
• You have Owner or Contributor access to all subscriptions

Verify via CLI

# List subscriptions and their management group parents
az account management-group show --name "cmp-iic-root" --expand --recurse \
  --query "children[].{Name:name, DisplayName:displayName, Children:children[].{Name:name, DisplayName:displayName, Subs:children[?type=='Microsoft.Management/managementGroups/subscriptions'].{Name:name, DisplayName:displayName}}}" \
  -o json

# PowerShell: verify all subscriptions under root
Get-AzManagementGroup -GroupName "cmp-iic-root" -Expand -Recurse |
    Select-Object -ExpandProperty Children |
    Format-Table Name, DisplayName, Type -AutoSize

Troubleshooting

Symptom	Error	Resolution
No enrollment account found	Empty result from az billing enrollment-account list	You need EA enrollment account owner role — contact your organization's EA admin
Subscription creation fails	AuthorizationFailed or BillingAccountNotFound	Verify your billing access — EA enrollment owner, MCA billing profile contributor, etc.
Cannot associate with MG	AuthorizationFailed	Verify Management Group Contributor role on the target MG
Subscription under wrong MG	Shows under root or Tenant Root Group	Move the subscription: az account management-group subscription add --name <target-mg> --subscription <sub-id>
Subscription quota exceeded	SubscriptionLimitReached	Request quota increase from Microsoft support
Subscription not visible	Not listed in Azure Portal	Verify you're signed into the correct tenant — check with az account show

Next Steps

Proceed to Task 03: Create Resource Groups

References

• Create Azure Subscriptions Programmatically
• Create EA Subscriptions
• Create MCA Subscriptions
• Move Subscriptions Between Management Groups
• Azure Subscription Limits

---

Navigation

Previous	Up	Next
Task 01 — Management Groups	Full Deployment Overview	Task 03 — Create Resource Groups

---

Version Control

• Created: 2026-01-15 by Hybrid Cloud Solutions
• Last Updated: 2026-03-19 by Hybrid Cloud Solutions
• Version: 3.0.0