I have a Subscription in my company that is shared for all members of the team (all employees). We use this subscription for test, dev and also production workloads. We have only one subscription because it is a sponsored subscription thanks to our MS partnership, so we don't want to create other subscriptions.
I want to restrict the access to a particular resource group that will host production resources where sensible data will be managed. Because all members of the teams are contributor in the subscription level, they have access to all resource group and I can't remove them from the resource group. So how can I proceed if I want to revoke their access to the resource group and allow them to use all other resource groups?