Scope

What it is

Scope is the level/hierarchy at which a control or assignment applies. In Azure governance there is a single hierarchy:

Management group → Subscription → Resource group → Resource

Why it exists

Scoping lets you delegate permissions and apply policies once, high in the hierarchy, and have them inherit down. It avoids repeating the same rule/allowance for every resource and gives administrators flexible, least-privilege control.

Key ideas

• RBAC scope — a role assignment made at a higher scope (e.g. subscription) applies to everything below it, unless overridden closer to the resource.
• Policy scope — an Azure Policy initiative applied to a management group affects all child subscriptions/resources.
• More-specific wins — an assignment/deny closer to the resource generally takes precedence over a broader one.
• Inheritance is the crucial mental model for both RBAC and Policy.

How it fits (diagram)

Exam notes

• Always consider scope when evaluating an RBAC or Policy scenario — the exam loves “which assignment applies here?”-type questions.
• Assign privileges at the highest scope that still grants least privilege, usually a resource group or subscription.

Related

management-groups · subscription · resource-group · role-assignment · azure-policy

📘 Source: Microsoft Learn — Scope