Resource group scope is the Azure permission boundary that limits what an identity can manage within a specific resource group. When a role is assigned at this level, the identity can act on all resources inside that group, but not necessarily on other groups or subscriptions. In practice, scope controls the blast radius of a credential or service principal.
This matters because attackers who compromise a cloud identity often use the permissions already granted to it. If that identity has broad resource group scope, destructive actions such as modifying or deleting multiple assets can be carried out through normal Azure management calls. Defenders reduce risk by applying least privilege, separating sensitive workloads into different groups, reviewing inherited role assignments, and using resource locks and alerts to detect unusual control-plane activity.