Azure Identity Management is a fairly large body on knowledge. Basically, dividing it into different areas makes if easier to understand.
RBAC in Azure:
Azure AD and B2C bother offer a way to authenticate a user thru the user providing an identity.
The user is assigned to 1 or more groups, and then the groups (or individual users) are assigned to Roles. The diagram below shows internal and external users and how permissions can be given out. Resulting in Role Based Access Control (RBAC). The application itself deals with the operations a user can perform but having the users role/claims allows the individual applications to figure out what action the user can perform.
RBAC can be assigned at 1 of these 4 levels to manage Azure Resources:
Tip: For small Azure Tenants, managing resources are the resource level works well, but in most enterprises, you should mange at the Resource group or even subscription level to keep management controllable.
RBAC in Azure:
Azure AD and B2C bother offer a way to authenticate a user thru the user providing an identity.
The user is assigned to 1 or more groups, and then the groups (or individual users) are assigned to Roles. The diagram below shows internal and external users and how permissions can be given out. Resulting in Role Based Access Control (RBAC). The application itself deals with the operations a user can perform but having the users role/claims allows the individual applications to figure out what action the user can perform.
RBAC can be assigned at 1 of these 4 levels to manage Azure Resources:
Tip: For small Azure Tenants, managing resources are the resource level works well, but in most enterprises, you should mange at the Resource group or even subscription level to keep management controllable.
Note: There is the concept of "Directory", multiple "Resource Groups" are setup to a directory. I believe all companies should have a single directory but it is more common to find even relatively small businesses common to have multiple directories.
"Multiple subscriptions can trust the same Azure AD directory. Each subscription can only trust a single directory." Microsoft Docs
