Best practices for assigning azure resources rbac

Hi everyone,

Hope all is well.

I’m learning about rbac for azure resources. I know how to apply rbac for azure ad side and pim use.

All the ms learn labs i’m seeing like very basic stuff like assign blob reader or vm owner,etc

I’m trying to setup like practical lab in my test environment.

In real world environments. How do you manage it. Do you have management groups and subscriptions that provide some inheritance access?

Let say someone requires access to a vm resource. Do you provide individual access? Is there chance deny access from subscriptions will over write it ?

If you know good documentation or guide. Please let me know as well.