Creating groups and adding users to them won't grant access to the Azure subscription or allow users to create resources. To enable a user to perform any actions within the subscription, you must specifically assign access to the Azure subscription.

If you want to prevent users from accessing any information within Entra ID as well, you can enable a setting within Entra ID. Go to Entra ID > User Settings > Restrict access to Microsoft Entra admin center, and click Enable.

Once enabled, normal users won’t be able to view Entra ID. However, if they are granted access to the Azure subscription, they can still access the subscription, while the restriction on Entra ID remains in place.