A subscription scope applies Azure RBAC permissions across resources within an Azure subscription. It gives an assignment broad reach while keeping authorization bounded by that subscription. section 2.3.2
Azure Policy also supports subscription scope. Assigning a policy there evaluates existing resources, reports compliance, and evaluates future deployments against the policy. section 10.2.2
Use subscription scope when governance or access requirements should cover the subscription:
- Target the scope with the form /subscriptions/{subID}. section 10.2.2
- Apply Azure Policy at the highest scope applicable to the organization, unless a narrower boundary is required. section 10.2.2
- Use roles and role definitions to determine which identities can perform which actions at the subscription scope. section 2.3.2
Restrict virtual machine sizes
Create an Azure Policy assignment at the subscription scope, provide a list of permitted VM SKUs such as Standard_D2s_v3 and Standard_D4s_v3, and inspect the resulting assignment JSON for its scope, parameters, policy definition, and enforcement mode. section 10.2.2
