What Azure construct should you use to group and isolate resources by workload or project?

Resource Groups are logical containers that hold related resources for an Azure solution. They allow you to group resources that share a common lifecycle, making it easier to manage, monitor, and delete them together. For example, all resources for a specific application or project (like virtual machines, storage accounts, and virtual networks) can be placed in one resource group. Management Groups are used to organize subscriptions into containers for governance and compliance at scale, applying policies and access control across multiple subscriptions. Subscriptions are billing units and provide a boundary for Azure services and resources, but they don't directly group resources by workload within themselves. Tags are metadata labels used to categorize resources for management, billing, or operational purposes, but they don't provide the isolation or management boundary that resource groups offer.