Azure RBAC Scope Hierarchy and Inheritance

In Azure, scope means the set of resources that access applies to. Scopes follow a hierarchy from broad to narrow: Management Groups sit at the top and can hold multiple subscriptions, which contain Resource Groups, which hold individual Resources like virtual machines or storage accounts. Understanding this hierarchy is essential because permissions assigned at a higher scope automatically flow down to everything below it.

Assigning a role involves selecting a scope, choosing a role definition (like Contributor for full resource management or Reader for view-only access), and then picking the security principal who receives it. The process works the same way whether you're working at the management group, subscription, resource group, or resource level—you search for the scope, open Access control (IAM), and add a role assignment. The key permission needed is Microsoft.Authorization/roleAssignments/write.