Assigning RBAC Roles at Resource Group Scope

What Access control (IAM) is

Access control (IAM), which stands for Identity and Access Management, is the dedicated management blade in the Azure portal used to manage Azure role-based access control (Azure RBAC). It provides a centralized interface to view existing access rights, check effective permissions, and assign built-in or custom roles to security principals.

How it meets the requirement

Selecting Access control (IAM) on the specific resource group allows administrators to:

• Open the Role assignments tab and select + Add > Add role assignment.
• Choose an appropriate role definition (such as Contributor or Virtual Machine Contributor) to grant precise privileges.
• Target the exact scope (the resource group level), ensuring that permissions automatically cascade to child resources within that group while preventing unauthorized access to other resources in the subscription.

Key advantages and capabilities

• Principle of least privilege: Restricts user capabilities to only the operations and resources needed for their duties.
• Support for multiple principal types: Allows assigning roles to individual users, Microsoft Entra groups, service principals, and managed identities.
• Inheritance management: Clearly illustrates inherited permissions from parent scopes like management groups and subscriptions.
• Auditability and visibility: Provides instant visibility into who has access and at what level through downloadable role assignment lists.

Why this is optimal

Access control (IAM) is the native, secure mechanism in the Azure portal designed specifically for governing authorization across Azure resources. Managing permissions here ensures granular access enforcement and compliance with security baselines.