Azure separation of environments

Question

I have a few Windows VMs on Microsoft Azure Cloud, their uses are: dev, test and production.

What would be the best way to separate the VMs to different isolated environments, so that people won't accidentally deploy a dev build on the prod server and things like that? At what entity level (billing, subscriptions, resource group...) should the separation happen?

Demands: 1. Different roles will be created to each environment, so dev people can't upload to test or prod. 2. Each environment should have the ability to define environment variables (for connection strings and passwords). 3. I don't use Visual Studio as my IDE. 4. I must use only one subscription, because I've got a subscription with free budget for a year, and I think that if I'd open another subscription - I'll have to pay.

Answer 1

As Peter Bons referred, the answer is: use a different Resource Group to represent an environment, and give users permissions to it.

link:

https://learn.microsoft.com/en-us/azure/active-directory/role-based-access-control-what-is