With Role-Based Access Control (RBAC) in Azure, you can implement the principle of least permissions and give users the exact permissions they need to do their jobs properly. Users, groups, and applications are added to roles in Azure, and those roles have certain permissions. You can use the built-in roles that Azure offers or you can create custom roles in RBAC.
The roles in Azure can be added to a certain scope. A Scope can be an Azure Subscription, an Azure Resource Group, or Web App, for instance. Azure then uses access inheritance. Roles added to a parent resource give access to child resources automatically. For instance, a group that is added to an Azure Subscription gets access to all the Resource Groups and underlying resources that are in that subscription as well. A user that is added to a virtual machine only gets access to that particular...