Who can access your Azure resources and what they can do can be determined by assigning roles at various scopes, including management groups, subscriptions, resources groups and individual resources.
- Management Group Level: you can apply roles to all subscriptions within the management group.
- Subscription Level: you can apply roles to all resource groups and resources within a subscription.
- Resource Group Level: you can apply roles to all resources within the resource group.
- Resource Level: apply roles to specific resources
To assign a roles in the Azure portal:
- Select the desired scope,
- Navigate to the Access control (IAM),
- Click + Add -> Add role assignment
- Select a role and assign it to a user, group or service principal