Common pitfalls (and quick corrections)
Most problems come from confusing layers and overusing high scope. Resources don't live in management groups. Management groups do not equal resource groups (different purposes). Avoid 'too broad' Azure RBAC at the top. Check notScopes and exemptions for exceptions.