Would you put Azure VMs in separate subscriptions from the rest of the workload?

I'd start with a subscription per application and environment, rather than splitting by resource type. If an application needs VMs and containers, keeping them together makes the workload boundary clearer.

That doesn't mean everyone needs the same access. The server team can manage the VMs while the DevOps team manages other resources, using roles scoped to the resources each team owns. Agree on who handles shared dependencies and support before settling on the permissions.

Separate VM subscriptions can work if the server team needs a clear operational boundary. Framework guidance is useful, but it doesn't have to dictate every subscription boundary.

Check the VM SKU quotas in each subscription before migrating or deploying. Also plan how the VM workloads will connect to resources in the other subscriptions and who will support those connections.

You may not need another subscription just to separate duties. Look at Azure RBAC first. You can assign the server team VM management and login roles at an appropriate scope, including through a management group where broad inheritance is intended.

Check the permissions against the actual tasks, though. VM administration can involve resources beyond the VM itself, so the built-in roles may not cover everything your team needs.

A hybrid setup is another option. Give applications with distinct owners or lifecycles their own subscriptions, and use team-owned subscriptions for general-purpose infrastructure. You could still separate production from nonproduction without making every subscription VM-only.

Whatever boundary you choose, consider making pipelines the normal way to change infrastructure. Give teams access to their repositories and pipeline identities the permissions they need, then reserve privileged portal access for the people who need it. That can keep responsibilities clear even when teams share a subscription.