Azure RBAC Scope Hierarchy and Inheritance

A role assignment links a role to a principal within a specific scope. Azure scopes are organized in a hierarchy: management group, subscription, resource group, and resource. Roles at a higher level automatically apply to all child scopes, enabling inheritance of permissions and simplifying access management.

Azure RBAC uses an additive model for permissions, meaning a user’s effective permissions are the union of all their role assignments. If a deny assignment exists, it overrides any allow permissions, highlighting the importance of deny rules. To decide if an action is allowed, Azure evaluates a series of steps: acquiring a token for Azure Resource Manager, retrieving assignments and any deny assignments for the requested resource, narrowing to role assignments for the principal (including transitive group memberships) and determining if the action is covered, and evaluating any conditions on the role assignment. This evaluation ensures secure and consistent access across all Azure resources.