Azure RBAC is about controlling access to resources inside an Azure subscription. Subscriptions in Azure can be broken out into Resource Groups which are common

Azure RBAC is about controlling access to resources inside an Azure subscription. Subscriptions in Azure can be broken out into Resource Groups which are commonly used for units of deployment. RBAC would restrict a login to a specific set of resource groups and actions (i.e. modify, don't delete). Azure has a similar account structure for enterprise customers. They get an root level enrollment and then have the flexibility to divide into "departments" and "accounts." Subscriptions live under accounts. Administrators and viewers can be assigned at any level and cost reporting is built into the enterprise portal. Policies cascade from higher levels down into accounts and subscriptions. Policies as JSON files that can control things like restricting regions, services, etc. Disclaimer: I work for Microsoft and Azure is my focus.