I would suggest azure has an approach that shows how iam can be a lot simpler. I can create a resource group, and make you a contributor on that group.

You now have full permissions to servers, storage and anything else created under that group without me having to enumerate them. If I want to create a new blob store under that group, you already have access without me having to edit iam. I can still make granular permissions where suitable.

Azure makes the path to having all console users require mfa much simpler too.