Role-Based Access Control

It was a dark and hostile time as little as five years ago in the Azure cloud when it came to granular access control. Azure Service Manager ruled, and there were essentially two types of people in a subscription: those that could do management actions (i.e., the service administrator and co-administrators) and those that could not (i.e., everyone who was not in the previously mentioned roles). These were subscription-level assignments, which meant it was common to have to separate resources and projects into separate subscriptions to enable separate security containers. Even then, however, often groups of people would have to be given permissions above what they actually needed, which breaks a fundamental security principal, least privilege—to only give what is required. This should guide you as you look at your RBAC design.

Introduced in 2014 and really becoming mainstream late 2015 was the Azure Resource Manager (ARM), which is what everything we know...