Pitfalls
Most issues come from confusing identity vs resources, or assigning at the wrong scope. Subscription is more than billing (governance boundary). Tenant (identity) does not equal subscription (resources). Separate workloads when you need cost/access clarity. RBAC scope inherits—assign carefully.