Azure RBAC: the scope is this assignment

The scope is the boundary on the row

An assignment lists a principal, a role name, and a scope. The scope is the resource id the assignment was made on. Contributor on one resource group is that resource group. It is not the subscription unless the scope says the subscription.

A second assignment is a second row. Do not merge two scopes because the role name matches.

The role name is not the scope

Owner, Contributor, and Reader are role names. They do not tell you the boundary. Owner at a resource is not Owner of the tenant. Quote the scope string with the role.

If the scope cell was cropped, write “scope not in the paste.” Do not assume the subscription.

What to write down

File the principal, the role, and the full scope. When you say “can manage,” repeat the scope. A shorter scope in the sentence is a different claim.

Lab: a resource-group Owner read as the subscription

Lab assignment: principal lab-ops, role Owner, scope the resource group rg-lab. A draft says lab-ops is Owner of the subscription because Owner sounds tenant-wide.

The note quotes Owner and the scope rg-lab. The subscription was not the scope. The draft’s wider claim is removed.

Snippet

principal: lab-ops
role: Owner
scope: resource group rg-lab
subscription assignment: not on this row
write: Owner of rg-lab
not: Owner of the subscription

Diagram

The role name and the scope

The name is what was granted. The scope is where.

Role

Is. Owner, Contributor, Reader, or another name

Does not. Set the boundary by itself

Scope

Is. The resource id on the assignment

Example. rg-lab, if that is the string

Wider than that. Only if another assignment says so

Check yourself

1. An assignment is Owner with scope rg-lab. Where is lab-ops Owner, from this row?

2. A second row gives Reader on the subscription. What do you have?

3. The paste shows the role and crops the scope. What do you write?