RBAC scope: management group vs subscription vs resource group
Verdict: Assign at the management group to reach every subscription beneath it; lower scopes inherit from higher ones. Tags cannot be applied to management groups, and budget action groups work only at subscription and resource group scope.
| Criterion | Management group | Subscription | Resource group |
|---|---|---|---|
| Reach of an assignment | Every subscription beneath it | That subscription and all its resource groups | Only that resource group |
| Inheritance | Top of the hierarchy; children inherit | Inherits from management group | Inherits from subscription |
| Can hold tags | No | Yes | Yes |
| Budgets supported | Yes | Yes | Yes |
| Budget action groups | Not supported | Supported | Supported |
| Pick for a single Reader across many subs | Assign here once | Would need repeating per subscription | Too narrow |
Rules
- A role assignment at management group scope applies to every subscription within it; lower levels inherit from higher, so one Reader assignment there covers all subscriptions beneath.
- Tags apply to resources, resource groups, and subscriptions, but never to management groups - use Azure Policy for governance at that level.
- Budgets under Azure RBAC are supported at management group, subscription, and resource group scopes.
Traps
- A subscription-scoped assignment reaches only that subscription, so it cannot cover every subscription in a grouping with a single assignment - use the management group.
- Budgets support more scopes than their action groups do: action groups can only be attached at subscription and resource group scope, not management group.