liveBook · Manning

Resource scope

As explained in Azure Security

Resource level is the narrowest Azure RBAC scope, applying permissions to one Azure resource.

Resource scope limits access to one Azure resource, making it the narrowest Azure RBAC scope. Restricting permissions this precisely supports least privilege and reduces the impact of a compromised identity. section 2.3.2

Azure applies role definitions at four scope levels:

  • Resource level: applies permissions to one resource. section 2.3.2
  • Resource group level: reaches resources within a resource group. section 2.3.2
  • Subscription level: reaches resources across a subscription. section 2.3.2
  • Management group level: reaches subscriptions, resource groups, and resources in its hierarchy. section 2.3.2

Resource scope in an Azure resource path

Azure represents a resource scope as a path such as /subscriptions/{subID}/resourceGroups/{rgName}/providers/{rType}/{rName}. Azure Policy can also evaluate resources at this scope, although policies should be assigned as high as applicable for organizational coverage. section 10.2.2

How Azure Security covers it

How deep it goes
Defines the narrowest of four Azure RBAC scopes and connects it to least privilege without detailing portal configuration.
Examples
Uses an Azure resource identifier path to show how resource scope is expressed.
What it assumes
Assumes familiarity with Azure resources and identities while defining scope within the who-what-on-what model.
What you can do after
Apply least privilege by assigning access to a single Azure resource instead of a broader hierarchy.
How it connects
Connects Azure RBAC, role definitions, role assignments, least privilege, Azure Policy, subscriptions, and resource groups.
Cover of Azure Security
liveBookmanning.com
Read Azure Security on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.