Who can access your Azure resources and what they can do can be determined by assigning roles at various scopes, including management groups, subscriptions, resources groups and individual resources. 

  • Management Group Level: you can apply roles to all subscriptions within the management group.
  • Subscription Level: you can apply roles to all resource groups and resources within a subscription.
  • Resource Group Level: you can apply roles to all resources within the resource group.
  • Resource Level: apply roles to specific resources

To assign a roles in the Azure portal:

  • Select the desired scope,
  • Navigate to the Access control (IAM),
  • Click + Add -> Add role assignment
  • Select a role and assign it to a user, group or service principal