Scope

What it is

Scope is the part of Azure to which a setting applies. For Azure RBAC, the management scope hierarchy is:

Management group → Subscription → Resource group → Resource

The higher the scope, the wider the effect. Scope lets Maya give Luis permission only for Northwind’s ordering resource group instead of every subscription, while still letting an organization apply a required policy to several subscriptions at once.

How it works

• An Azure RBAC role assignment at a higher scope, such as a subscription, is inherited by lower scopes. A narrower allow assignment adds permission; it does not remove a broader allow.
• An Azure Policy assignment at a management group affects descendant subscriptions and their resources, subject to its configuration and exclusions.
• Effective access is the combined set of applicable role assignments, constrained by applicable deny assignments. “More specific” does not automatically beat “broader.”

Northwind example

Maya assigns Luis Contributor at the orders-production resource group. He can manage that workload but not Northwind’s unrelated finance resources. If Maya instead assigned the same role at northwind-production subscription scope, Luis would inherit it for every resource group in that subscription. If she assigned it at the Production management group, he could inherit access into every descendant production subscription. The permission name is unchanged; the scope changes its reach.

Common confusion

• Scope answers “where does this setting apply?”, not “who is the person?” The identity is the principal; the role assignment connects the principal, role, and scope.
• The Microsoft Entra tenant is an identity boundary. The four usual Azure management scopes are management group, subscription, resource group, and resource.
• Azure Policy, RBAC, locks, and tags all use scopes, but they have different behavior. Do not assume a tag or an RBAC assignment can do what a Policy assignment does.

How it fits (diagram)

Practical rule

Grant access at the narrowest scope that lets the person do their work. Apply broad organization-wide governance only where the rule truly must cover every descendant. Then test the effective access and policy result rather than inferring it from a resource’s name or folder-like appearance.

Related

azure-management-hierarchy · management-groups · subscription · resource-group · role-assignment · azure-policy · northwind-traders-case-study

📘 Source: Microsoft Learn — Understand scope for Azure RBAC, checked 2026-09-16.