Azure Subscription and Management Group Naming Conventions

Azure subscriptions have no enforced naming rules, they are display names, so use a descriptive convention like contoso-platform-prod. Management groups have an immutable ID of 1 to 90 characters (alphanumerics, hyphens, underscores, periods, parentheses) plus a separate, changeable display name. Both sit above resource groups and set the structure for everything below.

Most naming guides focus on resources. But the two levels above your resource groups, subscriptions and management groups, are where policy, access control, and billing attach. Naming them clearly is what makes an Azure estate governable at scale. They also follow very different rules from resources.

The governance hierarchy

Management group (mg-contoso)
└── Management group (mg-landingzones)
    └── Subscription (contoso-online-prod)
        └── Resource group (rg-payments-prod-eus-001)
            └── Resources (kv-payments-prod-eus-001, ...)

Name the top two levels well and everything below becomes navigable. Get them wrong and no amount of tidy resource naming saves you.

Naming subscriptions

Here is the surprise: subscriptions have no enforced naming rules at all. A subscription name is a display name you can change anytime, with a practical limit around 64 characters. Azure does not validate a pattern, which means the discipline is entirely yours.

Because there is no typed resource, most conventions skip a sub- prefix (the community sub abbreviation exists but is not an official CAF prefix) and use a descriptive, hierarchical name instead:

{company}-{scope}-{environment}

Examples following the CAF enterprise-scale landing zone model:

Purpose	Subscription name
Management platform	contoso-management
Connectivity / networking	contoso-connectivity
Identity	contoso-identity
Production workloads	contoso-online-prod
Non-production workloads	contoso-online-dev
Corp / internal	contoso-corp-prod

The goal is that anyone reading the subscription picker knows exactly what lives where. Never leave the default Azure subscription 1.

Naming management groups

Management groups have two names, and the distinction matters:

• The ID (name): immutable once created. Used in ARM templates, policy assignments, and RBAC scopes. 1 to 90 characters, alphanumerics, hyphens, underscores, periods, and parentheses, must start with a letter or number, and cannot end with a period.
• The display name: shown in the portal, and it can be changed anytime.

Because the ID cannot be changed after creation, get it right the first time. The CAF prefix is mg:

mg-{scope}

A typical enterprise-scale hierarchy:

Level	Management group ID
Root (tenant)	mg-contoso
Platform	mg-platform
Platform: Management	mg-management
Platform: Connectivity	mg-connectivity
Platform: Identity	mg-identity
Landing zones	mg-landingzones
Landing zones: Corp	mg-corp
Landing zones: Online	mg-online
Sandbox	mg-sandbox
Decommissioned	mg-decommissioned

Structure management groups by function (platform, landing zones, sandbox), not by environment. Environment separation happens at the subscription level underneath.

Why the top of the hierarchy matters

Azure Policy and RBAC assignments made at a management group flow down to every subscription and resource beneath it. Billing rolls up the same way. So the management group and subscription names are the labels on your governance and cost boundaries. Clear names here make an audit readable; cryptic ones make it a guessing game.

Common mistakes

Leaving default subscription names. Azure subscription 1 tells nobody anything. Rename every subscription to its purpose.

Encoding environment in the management group ID. Management groups group by function; put prod versus dev at the subscription level.

Assuming the management group ID can be renamed. It cannot. Only the display name changes. Decide the ID carefully before creating it.

Adding a sub- prefix to subscriptions. It is not an official CAF convention and adds no value on a display name. Use a descriptive name instead.

Summary

• Subscriptions: no enforced rules, use a descriptive {company}-{scope}-{environment} display name, never the default
• Management groups: an immutable ID (1 to 90 characters, prefix mg) plus a changeable display name; structure by function
• These two levels carry policy, RBAC, and billing, so name them for auditability

Full rules are on the subscription and management group pages. AzureNamer generates names across the whole hierarchy. See the resource group naming guide for the level below, and the complete CAF guide for the fundamentals.