Scope

As explained in Microsoft Azure in Action

An authorization scope is the boundary of resources or areas to which an access or authorization assignment applies.

An authorization scope defines where an access assignment applies. In Azure RBAC, it works with a security principal and role definition to form a role assignment. section 6.7.3 section 6.7

Azure lets you target scope at four levels:

• Management group section 6.7.3
• Subscription section 6.7.3
• Resource group section 6.7.3
• Resource section 6.7.3

A focused resource-group assignment

Suppose Alpaca-Ma-Bags needs to manage resources, but only inside the AlpacaRG resource group. Open that resource group, choose Access Control (IAM), select Add Role Assignment, choose the built-in Contributor role, select the identity, and review the assignment. The scope limits the otherwise broad role to that resource group. section 6.7.3

Figure 6.34 Add a role assignment to the AlpacaRG resource group.

Use the role-assignment view to see how a resource group becomes the boundary for authorization. section 6.7.3

How Microsoft Azure in Action covers it

How deep it goes

Explains four target levels and demonstrates a resource-group assignment, without detailing scope inheritance or custom permission internals.

Examples

Demonstrates assigning the built-in Contributor role to an identity at the AlpacaRG resource-group scope through Access Control (IAM).

What it assumes

Assumes familiarity with Azure identities and resources while defining scope alongside security principals and role definitions.

What you can do after

Operate/configure Azure RBAC assignments that restrict an identity's permissions to a selected management group, subscription, resource group, or resource.

How it connects

Connects scope with RBAC, security principals, role definitions, role assignments, management groups, subscriptions, resource groups, and resources.

liveBookmanning.com

Read Microsoft Azure in Action on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  ASP.NET Core in Action, 3eA scope is a named permission describing an operation or resource that a client or user has been granted or consented to access.
• 

  liveBookmanning.com
  Authorization in ActionA scope is the policy element that identifies the principals, actions, and resources to which a policy applies.
• 

  liveBookmanning.com
  Azure SecurityA scope is the level and set of Azure resources to which a role assignment or governance configuration applies.
• 

  liveBookmanning.com
  Think Like a Software Engineering ManagerProject scope is the defined set of goals, requirements, deliverables, boundaries, assumptions, and exclusions for a project.
• 

  liveBookmanning.com
  Lead Developer Career GuideThe defined boundaries, objectives, deliverables, and work included in a project.
• 

  liveBookmanning.com
  Spring in Action, Sixth EditionAn OAuth2 scope is a named permission specifying the protected resources or claims a client may request from a provider.
• 

  liveBookmanning.com
  Build Python Web Apps with StreamlitScope is the boundary of functionality and behavior included in a software project or application.
• 

  liveBookmanning.com
  Spring Security in Action, Second EditionAn OAuth scope is a named permission value that limits the access or identity information requested by a client.

Compare how 9 books explain scope →

Related concepts

• prompt structurepart of · Prompt structure is the organization of a prompt’s content and instructions to guide a model’s response or generation.
• role assignmentpart of · A role assignment is an access-control configuration that grants a principal an authorization role or specified permissions for a defined scope.
• OAuthused by · OAuth is an authorization framework that enables a client to obtain limited, delegated access to protected resources without receiving the resource owner's credentials.
• principle of least privilegeimplements · The principle of least privilege is a security principle that grants each user, process, or other subject only the access rights necessary for its authorized tasks.
• api callequivalent to · An API call is a programmatic request or invocation through an application programming interface to access data or invoke an operation.
• Azure Policyused by · Azure Policy is an Azure governance service that evaluates resources against organizational rules and audits or enforces compliance.

This explainer was generated by Manning's knowledge graph from the text of Microsoft Azure in Action. The section links point to the parts of the book it draws on.