We now know what Azure is, what service models exist and where Contoso Airlines' platform is going to live. It is time to take the practical step: creating the account and leaving it configured securely and with no surprises on the bill.

This lesson is short on clicks and long on judgment. Signing up for Azure takes ten minutes; what separates a professional from an amateur is what they do in the twenty minutes that follow: turning on multifactor authentication, no longer working with the owner account, setting a budget and a spending alert, and understanding the difference between billing account, subscription and identity tenant. Doing it now costs half an hour; not doing it costs, at best, a fright on the bill.

1. What you need to get started
2. What the free account includes
3. Offer and subscription types
4. The billing and identity hierarchy
5. The sign-up process step by step
6. Essential hygiene from minute one
7. Budget and spending alert
8. How to avoid surprises on the bill
9. Contoso Airlines' subscriptions and environments
10. Common Mistakes and Tips
11. Exercises
12. Conclusion

To create an Azure account you need exactly three things:

About the card, two clarifications that reassure everybody:

• There is no automatic charge when the trial credit runs out. With the free account, when the credit or the trial period ends, paid services stop and you are asked to decide whether you want to move to pay-as-you-go. Nobody charges you without your explicit consent.
• Virtual prepaid cards are often rejected. If sign-up fails at the card step, try a conventional bank card.

Requirements you do not need: you do not have to be a company, have a tax ID or sign a contract. Marta Ríos, however, will register the Contoso account in the company's name, because a corporate Azure account must never depend on an employee's personal email.

The Azure free account combines three different things that are worth not confusing:

1. An initial trial credit that you can spend on practically any service for a limited period from sign-up (typically the first month). Once the credit or the period runs out, that credit disappears.
2. A set of free services for 12 months: limited quantities of certain popular resources (for example, a number of hours of specific virtual machine sizes, an amount of blob storage or a small database).
3. "Always free" services: resources that have a permanent free tier as long as you stay within their limits. Common examples: a monthly number of Azure Functions executions, the free App Service tier, certain Microsoft Entra ID services or Azure DevOps for small teams.

Important and honest warning: the specific figures (how much credit, how many hours, how many GB, which VM sizes) change frequently and vary by country. Do not memorize numbers and do not trust the ones you see on old blogs or videos. Always check the official Azure free account page at the moment you sign up.

Two nuances that cause unexpected bills:

• Free services are only free within their limits. Exceeding the free tier limit does not block the service: it bills it at the normal price.
• A resource created on a paid tier costs money from the first minute, even during the trial period: it is simply deducted from the credit, and when that runs out it is either charged or stopped depending on the account type.

A subscription is the billing unit and the container where resources live. Every resource belongs to exactly one subscription. The offer type determines prices, terms and management capabilities.

Recommendation for following this course: a free account if you have never had one, or pay-as-you-go if you have already used up the trial. Both work perfectly well. If you work at a company with an EA or CSP, ask for a separate development subscription; do not practice in the production one.

This is the part that causes the most confusion at first, because there are two parallel hierarchies that cross each other: billing and identity.

How to read the diagram:

• Billing account: it represents the commercial agreement with Microsoft. It is who receives the invoice. Depending on the offer type it will have profiles and sections (MCA/EA) or a simpler structure (pay-as-you-go).
• Subscription: a container for resources and a billing unit. Contoso will have two, one per environment.
• Resource group: a logical grouping within the subscription. We will look at it in detail in lesson 01-05.
• Microsoft Entra ID tenant: the identity directory. It pays nothing and contains no resources: it says who you are. A subscription trusts exactly one tenant to authenticate, although a tenant can have many subscriptions associated with it.

The key distinction, in one sentence: the subscription answers "who pays", the tenant answers "who you are" and the resource group answers "how I organize it".

There is a higher level, management groups, which let you apply policies and permissions to sets of subscriptions. We are not covering it here: it appears in lesson 01-05 when we discuss the full Azure Resource Manager hierarchy.

Everything related to users, groups, guests and roles is developed in module 4 (Microsoft Entra ID and RBAC), and everything related to cost analysis, reservations and optimization in module 8.

1. Go to the official Azure site and choose Start free (or Buy now if you are going straight to pay-as-you-go). Make sure you are on Microsoft's official domain: it is a classic impersonation target.
2. Sign in or create a Microsoft account. If your organization already uses Microsoft 365, use the work account: the existing tenant and the identities already created will be reused.
3. Profile details: country or region (careful, it cannot be changed afterwards, and it determines currency and taxes), name, address, email and phone.
4. Phone verification: you receive a code by SMS or call.
5. Card verification: you enter the card; a temporary authorization for a token amount is placed and released within a few days. It is not a charge.
6. Subscription agreement: you accept the terms and the privacy statement.
7. In a couple of minutes the subscription is created and you land in the Azure portal (which we will tour in lesson 01-04).

Once you are in, check what you have:

Sample output (the identifiers are fictitious):

We have not installed the CLI yet — that is lesson 01-06 — but you can run this command from Cloud Shell, the portal's built-in terminal, without installing anything.

Four measures. None is optional in a serious environment, and they all apply equally to a learning account.

The account you sign up with is, by default, the most powerful one in your environment: it can create resources, change payment methods and grant permissions to others. A password alone is not defense enough.

• Turn it on for all administrative accounts, starting with yours.
• Preferably use an authenticator app (such as Microsoft Authenticator) instead of SMS.
• Store the recovery codes somewhere safe outside Azure.

Microsoft has been progressively making MFA mandatory for administrative access to Azure, so you may as well get ahead of it. Conditional access policies and identity details are covered in module 4.

The account that created the subscription is the equivalent of the building's master key. Good practice:

• Create named users for daily work, with permissions tailored to what each person needs (principle of least privilege).
• Keep the owner account for exceptional tasks: changing billing, recovering access.
• At Contoso: Marta Ríos administers the infrastructure with her own user holding the Contributor role over the resource group she is responsible for; Diego Salas has Contributor only in development. The owner account is kept under lock and key.
• Document who has emergency access. Many organizations keep a break-glass account with credentials stored physically.

The details of roles and assignments (RBAC) are content for module 4; here the habit is enough.

"Azure subscription 1" tells nobody anything six months from now. Rename it from the portal (Subscriptions → select → Rename) or from the CLI:

Write down in a team document: subscription ID, tenant domain, who the owner is, which email address it was registered with and which payment method is associated with it. It sounds bureaucratic right up until the day that person is off sick.

This is the measure that avoids the classic anecdote of "I left a big VM running for a month". Create it before deploying anything.

An Azure budget does not block spending: it watches and warns. When the accumulated spend for the period reaches a percentage you define, it sends emails and can trigger automatic actions.

1. Search for Cost Management in the global search box.
2. Select the scope (your subscription).
3. Budgets → Add.
4. Define: name (presupuesto-mensual-contoso), monthly reset period, expiry date and amount (for example, EUR 50 if you are learning).
5. Add alert conditions: 50%, 80% and 100% of the budget, with the destination email addresses.

Practical note: configuring the threshold alerts (50%, 80%, 100%) is more convenient from the portal, because the CLI requires you to pass the notification structure in JSON format. If you are just starting out, create the budget in the portal and add the three alerts there.

Here is an example of what the notification definition looks like in JSON format, so that you understand what lies underneath:

Note thresholdType: Actual warns you when you have already spent that percentage; Forecasted warns you when Azure predicts that you will reach it at the current rate. The second one arrives earlier and gives you room to react. Use both.

Check spending at any time:

In-depth cost analysis, forecasts, reservations and FinOps culture are the content of module 8. Here we are just putting up the safety net.

Practical rules you should internalize right now:

• Whatever you are not using, stop it or delete it. Stopping a virtual machine from the portal (Stop, which deallocates it) releases the compute cost, but the disk is still paid for. If it is a test, delete the whole thing.
• Work with disposable resource groups. If everything from an exercise lives in one group, deleting it removes everything in one go. We will automate this in lesson 01-06.
• Watch out for resources that never switch off. Static public IP addresses, orphaned disks, VPN gateways, load balancers, reserved IPs and databases keep billing even with no traffic.
• Keep an eye on service tiers. Choosing an oversized App Service plan or database tier "just in case" is the most expensive and most silent mistake.
• Review the first month's invoice in detail, line by line. It is the best way to learn what Azure actually charges for.
• Outbound traffic is billed. Data coming into Azure is free; data going out to the internet is not.

And a golden rule for this course: when you finish each exercise, delete the resource group you created.

Marta Ríos decides to separate environments by subscription, not just by resource group. The reason: to isolate billing, to be able to apply different policies and to prevent one of Diego's experiments from affecting production.

And within each subscription, the first resource group of each environment, with the names we will use throughout the course:

• rg-contoso-reservas-pro in the production subscription.
• rg-contoso-reservas-dev in the development one.

Both in the West Europe region, with the mandatory tags we will formally establish in lesson 01-05: entorno, proyecto=contoso-reservas, centro-coste=CC-1042 and propietario.

If you are following the course with a personal free account, you do not need two subscriptions: simulate the two environments with the two resource groups inside the same subscription. All the examples in the course work just the same.

A quick view of the resulting organization:

• Registering the corporate account with an employee's personal email. The day that person leaves, the company has a serious ownership problem. Use a corporate identity from the start.
• Choosing the wrong country at sign-up. It cannot be changed afterwards: it affects currency, taxes and the offers available to you.
• Believing the free account prevents all spending. Free services are free within their limits; exceeding them is charged. And if you voluntarily move to pay-as-you-go, the safety net is gone.
• Thinking a budget stops spending. It does not stop it: it warns. If you want automatic brakes, you have to combine it with automation (module 7) or policies (module 4).
• Leaving MFA "for later". Azure accounts without MFA are the number one attack vector, and a compromised subscription gets used to mine cryptocurrency with bills of thousands of euros.
• Always working as owner. Convenient right up until the accidental deletion. Create users with the minimum privilege they need.
• Not looking at the bill until the end of the month. Configure forecast alerts (Forecasted) and take a weekly look during the first few weeks.
• Cost tip: during this module you will only create a resource group (free) and, in the next lesson, a storage account on its cheapest tier (a few cents if you store very little). Even so, delete everything when you are done.

State which offer type you would recommend in each situation and why:

1. You are studying on your own and want to practice this course without spending money.
2. Diego Salas has a company Visual Studio subscription and wants to set up a test environment.
3. Contoso Airlines wants to move its sales platform into production, with corporate invoicing and volume discounts.
4. An SME wants to use Azure but would rather have a local partner invoice it and provide support in Spanish.

Place these elements in the correct order of containment (from largest to smallest) and point out which one does not belong to the billing hierarchy: resource, billing account, Microsoft Entra ID tenant, resource group, subscription.

Then answer: can an organization have a single tenant and several subscriptions? And several tenants with a single subscription?

Carry out these tasks in your own account (or describe them step by step if you have not created it yet):

1. Rename your subscription to Contoso Airlines - Producción.
2. Turn on multifactor authentication for your account.
3. Create a monthly EUR 20 budget with alerts at 50% actual, 80% actual and 100% forecast.
4. Explain the difference between the "80% actual" alert and the "100% forecast" one, and why it is worth having both.

Solution 1:

1. Free account (or Azure for Students if you have an academic email address): trial credit and free tiers, with no risk of unexpected charges.
2. Visual Studio subscription: it includes monthly credit and reduced rates for development and testing. Remember that it is not allowed for production workloads.
3. Enterprise Agreement or Microsoft Customer Agreement, depending on the volume and the negotiated deal: commitment discounts and centralized billing management.
4. CSP through a partner: the partner provides the invoice and the support.

Solution 2:

Order of containment in billing: billing account → subscription → resource group → resource.

The Microsoft Entra ID tenant does not belong to that hierarchy: it is the identity dimension, running in parallel. It contains no resources and receives no invoices; it authenticates whoever is accessing.

• One tenant with several subscriptions? Yes, and it is the usual arrangement (Contoso has production and development under the same tenant).
• Several tenants for one subscription? No. A subscription trusts exactly one tenant at any given time (although it can be transferred to another one, with significant consequences for permissions, which are lost).

Solution 3:

1. Portal → Subscriptions → select the subscription → Rename; or az account subscription rename.
2. Microsoft Entra ID portal → Users → your account → authentication methods; or through the tenant's security defaults. Register the Authenticator app and store the recovery codes.
3. Cost Management → Budgets → Add: amount 20, monthly period, and three alert conditions: 50% Actual, 80% Actual, 100% Forecasted.
4. The actual alert ("80% actual") tells you what you have already spent: it is a done deal. The forecast alert ("100% forecast") uses the consumption trend to anticipate that you are on track to exceed the budget, and it can arrive days earlier. The first confirms, the second prevents; together they give you a diagnosis and room to react.

Creating the Azure account is quick: a Microsoft account, a phone and a card for verification — with no automatic charges. What matters is what comes next. You have seen what the free account really includes (trial credit, free services for 12 months and always-free services, with figures that change and need to be checked), what offer types exist (free, pay-as-you-go, Visual Studio, EA, CSP) and, above all, how billing account, subscription, resource group and Microsoft Entra ID tenant relate to each other: who pays, how it is organized and who you are.

And you have applied the minimum hygiene: MFA turned on, owner account set aside, subscription with a useful name and a budget with actual and forecast alerts before creating anything. Contoso Airlines is left with its two environments defined, Contoso Airlines - Producción and Contoso Airlines - Desarrollo, each with its budget and its owner. Identity is explored in depth in module 4 and cost in module 8.

With the account ready and protected, we can go in and look around. In the next lesson, A Tour of the Azure Portal, you will learn to move around the web console, customize it and create your first resources: the rg-contoso-reservas-dev group and the storage account for boarding passes.