Managing users with hierarchies
A core principle for any system should be Least Privileged Access – that is, only allow access to something if it is required. Or, to put it another way, don't just give every user full owner access to everything! If a user only needs to manage storage accounts, only provide access to storage accounts.
To help manage access, a strategy of how these roles can be applied must be considered and designed.
After all, if you have thousands of users, granting access to each user on a per resource type basis would be unmanageable!
Management groups, subscriptions, and resource groups
We can assign user access to the resources they need at different scopes – management groups, subscriptions, resource groups, or individual resources. As we can see in the following figure, the relationships between these scopes are hierarchical, and permissions or roles set at the highest management group scope flow down to the child levels:
Figure...
