Assigning Roles at Different Scopes

Who can access your Azure resources and what they can do can be determined by assigning roles at various scopes, including management groups, subscriptions, resources groups and individual resources. 

• Management Group Level: you can apply roles to all subscriptions within the management group.
• Subscription Level: you can apply roles to all resource groups and resources within a subscription.
• Resource Group Level: you can apply roles to all resources within the resource group.
• Resource Level: apply roles to specific resources

To assign a roles in the Azure portal:

• Select the desired scope,
• Navigate to the Access control (IAM),
• Click + Add -> Add role assignment
• Select a role and assign it to a user, group or service principal