Azure RBAC Scope Hierarchy

The process starts by selecting a scope, which defines how broad the permissions are. You can assign a role at the level of a management group, subscription, resource group, or an individual resource. You navigate to the desired resource in the portal and open its Access control (IAM) page.

On the Access control (IAM) page, you select Add role assignment. You then choose a built-in role (like "Contributor" or "Reader"), select the members (users or groups) to assign it to, and review the settings. After you assign the role, you can return to the same page at any time to edit or remove the assignment, allowing you to manage access securely as needs change.