Skills azure-rbac

📦

azure-rbac

Name: azure-rbac
Author: microsoft

v0.0.0-placeholder Content revision r2 Safe ⚙️ External commands

Choose Least-Privilege Azure RBAC Roles

Selecting an Azure role with excessive permissions increases security risk. This skill recommends minimal roles and prepares Azure CLI and Bicep assignments.

Supports: Claude Codex Code(CC)

🥈 80 Silver

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "azure-rbac" from https://skillstore.io/skills/microsoft-azure-rbac.md and its manifest at https://skillstore.io/api/skills/microsoft-azure-rbac/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/microsoft-azure-rbac.md Signed manifest GET /api/skills/microsoft-azure-rbac/manifest Signed lockfile GET /api/skills/microsoft-azure-rbac/lockfile

Test it

Using "azure-rbac". A managed identity must read blobs from one storage account.

Expected outcome:

Recommended role: Storage Blob Data Reader.
Scope: the specific storage account or narrower container scope.
Next step: review generated Azure CLI and Bicep assignments.

Using "azure-rbac". Which role lets an operator create role assignments without full resource control?

Expected outcome:

Use User Access Administrator when role assignment is the only required administrative capability. Owner grants broader resource control.

Using "azure-rbac". No built-in role matches a limited set of resource actions.

Expected outcome:

Compare requested actions against current built-in roles.
Define a custom role containing only required actions.
Review assignable scopes before generating deployment guidance.

Security Audit

Safe

v5 • 7/23/2026 Open versioned report

Both static findings are false positives caused by Markdown inline-code delimiters around an Azure permission name. The skill contains no executable shell or Ruby command at those locations.

Files scanned

Lines analyzed

Review items

False positives ignored

Risk Factors

⚙️ External commands (2)

SKILL.md:13 SKILL.md:17

No confirmed security findings were detected by the latest completed static and semantic audit. This does not prove the skill has no side effects.

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/microsoft-azure-rbac/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/microsoft-azure-rbac/security.svg)](https://skillstore.io/skills/microsoft-azure-rbac?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/microsoft-azure-rbac?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/microsoft-azure-rbac/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/microsoft-azure-rbac.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

microsoft. (2026). azure-rbac security audit report (audit version 5) [Author version 0.0.0-placeholder]. Skillstore. https://skillstore.io/skills/microsoft-azure-rbac/audits/5

BibTeX citation

@techreport{microsoft-microsoft-azure-rbac-2026,
  author = {microsoft},
  title = {azure-rbac security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/microsoft-azure-rbac/audits/5},
  note = {Author version 0.0.0-placeholder}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "azure-rbac security audit report (audit version 5)"
version: "0.0.0-placeholder"
type: report
authors:
  - name: "microsoft"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/microsoft-azure-rbac/audits/5"
identifiers:
  - type: other
    value: "skillstore:microsoft-azure-rbac:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

100

Spec Compliance

What You Can Build

Grant Storage Read Access

Identify the minimal role for an application that only reads blobs at a defined scope.

Automate Role Assignments

Prepare Azure CLI and Bicep assignments for managed identities in repeatable infrastructure deployments.

Design a Custom Role

Define limited permissions when available built-in roles grant more access than required.

Try These Prompts

Find a Built-In Role

Find the least-privileged Azure role that lets [identity] perform [actions] on [resource scope]. Explain why it fits.

Prepare an Azure CLI Assignment

Recommend the minimal role for [identity] at [scope], then prepare the Azure CLI assignment command.

Create a Bicep Assignment

Create Bicep guidance assigning the least-privileged role to [principal] at [scope]. Include required identifiers and dependencies.

Design a Custom Role Workflow

Compare built-in roles for [required actions]. If none fit, define a minimal custom role and provide CLI and Bicep assignment guidance.

Best Practices

Use the narrowest practical assignment scope.
Confirm required actions before selecting a role.
Review generated commands and Bicep through normal change controls.

Avoid

Do not assign Owner when a narrower role meets the requirement.
Do not create a custom role before checking built-in roles.
Do not deploy generated assignments without validating identity and scope identifiers.

Frequently Asked Questions

Does this skill deploy Azure role assignments?

No. It provides recommendations and generated guidance for review and deployment.

Can it recommend built-in Azure roles?

Yes. It searches Azure documentation for a minimal role matching the requested permissions.

When does it suggest a custom role?

It suggests a custom role when no built-in role matches the required permissions closely enough.

Does it generate Azure CLI commands?

Yes. It can generate role assignment commands after identifying the role, identity, and scope.

Does it support Bicep?

Yes. It provides Bicep guidance for adding role assignments to infrastructure deployments.

Which permission is required to assign roles?

The granting identity needs Microsoft.Authorization/roleAssignments/write, usually through User Access Administrator, Owner, or a suitable custom role.