Diagram
A top-down hierarchy showing how Azure RBAC scopes flow from Microsoft Entra tenant through management group, subscription, resource group, and individual resource, with permissions inherited by all child scopes.
Scoping Assignments for Least-Privilege
The Azure authorization system evaluates permissions hierarchically. An assignment at a parent scope (like a subscription) grants those permissions to all child resources (like resource groups and VMs within it). Therefore, you must carefully choose the narrowest assignableScopes when defining the role and the narrowest scope when making the assignment. This layered control ensures that permissions are contained and do not inadvertently spread, maintaining a secure boundary between different parts of your environment.
Domain 2 of 6
2 practice questions
Practice this DomainLast updated