Roles are assigned at management-group scope to groups, never to users at resource scope. A subscription added to the right management group inherits its access model rather than needing one built.
Environments differ only in their access model — DEV has standing Contributor, PROD has eligible-only with approval, MFA and a four-hour maximum. The infrastructure code is otherwise identical, so promotion changes configuration and not architecture.
One group per application per environment. Generic shared groups were rejected explicitly: they are what turns a landing zone boundary into a suggestion.
The isolation control
An Azure Policy deny blocks any role assignment in PROD whose principal already holds a role in DEV or TEST. That makes cross-environment escalation impossible rather than discouraged.
The sandbox management group has no hub peering and no data, so an experiment cannot reach a production endpoint even with a valid credential.
Decommissioned subscriptions land in a quarantine group that denies inbound role assignments, which stops the classic pattern of a forgotten subscription becoming a persistence foothold.
Assumptions
22 subscriptions across four environments, growing by roughly six per year. The topology is designed for growth by adding subscriptions to existing groups, not by adding depth.
Platform and application ownership are genuinely separate teams. If one team owns both, the topology still works but the separation-of-duties claim in view 24 weakens.
Resource locks are on production storage and Key Vault only. Locking everything creates operational friction that gets solved by removing locks.
