Azure ED Modules and API API Calls

There's a bunch of different resources like virtual machines are probably the primary resource but then there's all kinds of different things like subnets, networks, virtual networks and VPNs. Anything that you can do in Azure is going to be typically a part of a resource. And so as a VM contributor I have rights over if it's assigned at the subscription level, meaning where everything. Every resources exists every resource exists in a subscription. So if I assign to the subscription level I have everything in that subscription every VM I am now a VM contributor over. Now what commonly happens is instead of trying to create a customer role and make everything more granular in terms of permissions and minutratives