A municipal-water lab assigns Backup Contributor at the subscription and then finds the same principal can start backup jobs in every child resource group. How should the team shrink that blast radius while keeping Azure RBAC inheritance behavior accurate?
Select an answer to reveal the explanation.
Short Explanation
Azure RBAC flows downhill like water—there is no dam labeled “block inheritance.” If the lab only wants a few resource groups wet, assign Backup Contributor on those groups and pull the subscription-wide hose.
Full Explanation
Role assignments at a parent scope are inherited by child scopes. Azure RBAC does not provide a block-inheritance control; narrowing access means assigning at a tighter scope or using a less privileged role. Azure Policy Deny is a separate control plane and does not cancel inherited RBAC grants.