Four levels, and policy set anywhere flows to everything below it.
Folders exist purely for grouping and inheritance — they hold no resources of their own.
OrganizationRoot node — domain-linked or now, standalone
FoldersNestable grouping — by environment or by team
ProjectsThe real isolation boundary
ResourcesVMs, buckets, tables, topics
Standalone vs. domain-linked
RequiresDomain-linkedStandalone
Cloud IdentityYesNo
Domain verificationYesNo
Federated ownersLimitedYes
Delete & restoreNoYes
Design folders around what needs a different policy, not around the org chart — matching policy on both sides adds depth with zero governance benefit.