RBAC (Role-Based Access Control) and scope
Pick the smallest scope that still lets the team do the job. RBAC controls 'who can do what'. Subscription roles: broad operations access. Resource group roles: narrower team access. Inheritance means scope choice matters.