Scope defines the Azure resources affected by an access-control or governance configuration. In Azure RBAC, a role assignment joins a security principal and role definition to a scope, determining where its permissions apply. Removing that assignment removes the granted access. section 2.3.2 section 2.3.3
Choose scope deliberately: a broad scope can cover many descendant resources, while a narrow scope limits impact. For Azure Storage control-plane roles, assignments can target a management group, subscription, resource group, or individual storage account. Apply least privilege by selecting the narrowest scope that meets the operational need. section 5.1.2
Azure Policy supports these scope levels:
- Management group: /providers/Microsoft.Management/managementGroups/{mgName}. section 10.2.2
- Subscription: /subscriptions/{subID}. section 10.2.2
- Resource group: /subscriptions/{subID}/resourceGroups/{rgName}. section 10.2.2
- Resource: /subscriptions/{subID}/resourceGroups/{rgName}/providers/{rType}/{rName}. section 10.2.2
For Azure Policy, assign at the highest scope applicable to the organization. The assignment evaluates existing resources, reports compliance, and evaluates later deployments. Higher-level assignments also help avoid overlapping policies; where overlap exists, the most restrictive policy takes precedence. section 10.2.2 section 10.4
Restrict VM SKUs in a subscription
Assign an Allowed virtual machine size SKUs policy definition with a subscription ID passed to --scope. The assignment records that scope alongside the policy definition and permitted SKU parameters; the same pattern can be applied at other supported scopes. section 10.2.2
Listing 10.1 Assigning an Azure Policy definition
az policy assignment create --name 'Allowed Virtual Machine SKUs' #1 --display-name 'Allowed Virtual Machine SKUs' #2 --scope '/subscriptions/ 00000000-0000-0000-0000-000000000000' #3 --policy 'cccc23c7-8427-4f53-ad12-b6a63eb452b3' #4 --params '{ "listOfAllowedSKUs": { "value": ["Standard_D2s_v3", "Standard_D4s_v3", "Standard_DS1_v2", "Standard_DS2_v2"]}}' #5 --output jsonc #6 #1 The actual name of the Azure Policy assignment #2 The display name of the Azure Policy assignment #3 The scope on which the assignment is created #4 The policy definition ID #5 The JSON-formatted string containing parameters of the policy assignment #6 The output format
Inspect the policy-assignment command to see how --scope identifies the subscription affected by the VM SKU restriction. section 10.2.2
