Resource group scope limits an Azure RBAC assignment or Azure Policy assignment to resources within a named resource group. Use it when governance or permissions should be narrower than a subscription but broader than one resource. section 2.3.2 section 10.2.2
A resource group scope is useful for:
- Granting granular permissions, such as allowing a principal to perform specific write operations on resources in a resource group. section 2.3.2
- Applying Azure Policy to resources in the resource group, where existing resources are evaluated and future deployments are checked for compliance. section 10.2.2
Exempting a resource group from a policy
The Azure CLI example creates the exemptTestVM exemption for the Allowed Virtual Machine SKUs assignment and targets testVMsRG. The Waiver category accepts noncompliance for that resource group.
