How does assigning an account group to an administrative user on Prisma Cloud help restrict access to resources?

The restriction is not to all resources universally; it is specifically scoped to the accounts within the assigned group, leaving other accounts inaccessible.

Account group assignment restricts by cloud account scope, not by resource type - the user can see all resource types within the in-scope accounts.

Account groups in Prisma Cloud are the primary mechanism for scoping administrative access - when a user is assigned to an account group, they can only view and act on resources, alerts, and data belonging to the cloud accounts within that group. This enables multi-tenant or team-based access control where different administrators manage different subsets of an organization's cloud footprint. The restriction applies across the board to resources and data, not just to specific resource types.

Account group assignment does impose access restrictions; a user without an account group assignment would have no meaningful data scope in Prisma Cloud.