A financial services organization is implementing a cloud governance strategy across its expanding Azure infrastructure. The security team must delegate operational management of virtual machines and databases to development teams while ensuring that developers cannot modify billing configurations, delete subscriptions, or access resources in production environments. Which Azure feature should the organization use to assign and restrict fine-grained resource permissions across management scopes?

Azure role-based access control (Azure RBAC): ### What Azure RBAC Is **Azure role-based access control (Azure RBAC)** is an authorization system built on **Azure Resource Manager** that provides fine-grained access management of Azure resources. It allows organizations to grant only the precise permissions that users, groups, and service principals need to perform their daily duties, enforcing the security principle of **least privilege**. ### How It Meets the Requirements - **Fine-Grained Permission Assignment**: **Azure RBAC** enables precise delegation of operational actions (such as managing virtual machines and databases) through built-in roles like **Contributor** or custom roles. - **Scope-Based Access Control**: Permissions can be applied at multiple hierarchical levels, including **management groups**, **subscriptions**, **resource groups**, and individual resources, preventing developers from accessing unauthorized production scopes. - **Separation of Concerns**: RBAC isolates operational resource management from subscription-level **billing management**, ensuring developers cannot alter billing relationships or delete root-level subscriptions. ### Key Advantages and Capabilities - **Hierarchical Inheritance**: Role assignments made at higher scopes (such as management groups or subscriptions) inherit downward to child resource groups and resources. - **Extensive Built-In Roles**: Provides dozens of pre-configured roles like **Owner**, **Contributor**, and **Reader** tailored to standard administrative tasks. - **Identity Integration**: Integrates natively with **Microsoft Entra ID** users, security groups, and managed identities for seamless authentication and authorization. - **Custom Role Definitions**: Supports creating tailored JSON role definitions when specialized control and granular actions are necessary. ### Why This Is Optimal Unlike broad subscription administrator privileges or metadata labeling, **Azure RBAC** is designed specifically to enforce authorization boundaries. It provides granular, auditable control over cloud resource operations across distinct organizational scopes without exposing sensitive billing and account management capabilities.