azure-rbac
microsoft/azure-skills
Find the least-privilege Azure RBAC role, then generate CLI commands and Bicep code to assign it.
What is azure-rbac?
azure-rbac helps you identify the minimal built-in Azure RBAC role for a given identity and set of permissions. If no built-in role fits, it generates a custom role definition. It then produces the Azure CLI commands and Bicep code needed to assign that role. It also explains what permissions are required to perform role assignments.
- Searches Azure documentation to find the least-privilege built-in role matching desired permissions
- Generates a custom role definition when no built-in role fits
- Produces Azure CLI commands to assign the identified role to an identity
- Generates Bicep code snippets for role assignments using best-practice schemas
- Explains which roles are required to perform role assignments (e.g. User Access Administrator)
- Covers common scenarios: managed identities, blob access, resource-scoped assignments
How to install azure-rbac
npx skills add https://github.com/microsoft/azure-skills --skill azure-rbac- Azure CLI installed if you intend to run generated CLI commands
- Sufficient Azure permissions to assign roles: User Access Administrator, Owner, or a custom role with Microsoft.Authorization/roleAssignments/write
- An Azure subscription and target resource or resource group scope identified
How to use azure-rbac
- 1.Install the skill with: npx skills add https://github.com/microsoft/azure-skills --skill azure-rbac
- 2.Describe the identity (e.g. managed identity, service principal) and the access it needs
- 3.The skill searches Azure documentation for the minimal matching built-in role
- 4.If no built-in role matches, the skill generates a custom role definition
- 5.Review the suggested role and confirm it meets your requirements
- 6.Use the generated Azure CLI commands to assign the role
- 7.Use the generated Bicep snippet to include the role assignment in your IaC
- 8.If you need to know what role grants you permission to assign roles, ask about prerequisites
Use cases
- Assigning the correct role to a managed identity with minimal permissions
- Finding the right role for read-only blob storage access
- Creating a custom RBAC role when built-in roles are too broad
- Generating Bicep code for role assignments in infrastructure-as-code
- Determining what role your account needs before granting access to others
- Azure developers writing Bicep or ARM templates
- Cloud engineers setting up least-privilege access policies
- DevOps teams automating role assignments via Azure CLI
- Security-conscious teams auditing or tightening Azure permissions
- Developers configuring managed identity access to Azure resources
azure-rbac FAQ
The skill will generate a custom role definition with exactly the permissions you need using the azure__extension_cli_generate tool.
You need a role with Microsoft.Authorization/roleAssignments/write. The least-privilege option is User Access Administrator; Owner also works.
Yes. It produces Azure CLI commands for imperative assignment and a Bicep code snippet for infrastructure-as-code deployments.
Yes. Managed identity role assignment is an explicitly supported scenario.
Yes. It always looks for the minimal built-in role first before suggesting broader roles or custom definitions.
Full instructions (SKILL.md)
Source of truth, from microsoft/azure-skills.
name: azure-rbac description: "Helps users find the right Azure RBAC role for an identity with least privilege access, then generate CLI commands and Bicep code to assign it. Also provides guidance on permissions required to grant roles. WHEN: bicep for role assignment, what role should I assign, least privilege role, RBAC role for, role to read blobs, role for managed identity, custom role definition, assign role to identity, what role do I need to grant access, permissions to assign roles." license: MIT metadata: author: Microsoft version: "1.1.1"
Use the 'azure__documentation' tool to find the minimal role definition that matches the desired permissions the user wants to assign to an identity. If no built-in role matches the desired permissions, use the 'azure__extension_cli_generate' tool to create a custom role definition with the desired permissions. Then use the 'azure__extension_cli_generate' tool to generate the CLI commands needed to assign that role to the identity. Finally, use the 'azure__bicepschema' and 'azure__get_azure_bestpractices' tools to provide a Bicep code snippet for adding the role assignment. If user is asking about role necessary to set access, refer to Prerequisites for Granting Roles down below:
Prerequisites for Granting Roles
To assign RBAC roles to identities, you need a role that includes the Microsoft.Authorization/roleAssignments/write permission. The most common roles with this permission are:
- User Access Administrator (least privilege - recommended for role assignment only)
- Owner (full access including role assignment)
- Custom Role with
Microsoft.Authorization/roleAssignments/write
Related skills
More from microsoft/azure-skills and the wider catalog.
finetuning
Fine-tune models on Azure AI Foundry with SFT, DPO, or RFT training methods.
azure-ai
Azure AI services skill for Search, Speech, OpenAI, and Document Intelligence in coding agents
azure-deploy
Execute Azure deployments for prepared applications with built-in error recovery and validation.
azure-diagnostics
Debug Azure production issues using AppLens, Azure Monitor, resource health, and systematic triage.
azure-prepare
Generate Azure deployment infrastructure (Bicep/Terraform, azure.yaml, Dockerfiles) for new or existing apps
azure-storage
Azure Storage skill: Blob, File Shares, Queue, Table, and Data Lake with access tier guidance and lifecycle management