# Choose Least-Privilege Azure RBAC Roles

Selecting an Azure role with excessive permissions increases security risk. This skill recommends minimal roles and prepares Azure CLI and Bicep assignments.

## Install

```bash
npx skillstore add microsoft/azure-rbac
```

## Metadata

- Status: approved
- Slug: microsoft-azure-rbac
- Version: 0.0.0-placeholder
- Author version: 0.0.0-placeholder
- Skillstore revision: r2
- Version status: valid
- Tree hash: a1e67724183ea045271bb656c9fa73839946a953f294c0f4deea4764c20916d1
- Author: microsoft
- GitHub username: microsoft
- License: MIT
- Repository: https://github.com/microsoft/github-copilot-for-azure/tree/main/plugin/skills/azure-rbac/
- Ref: ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands
- Quality score: 80
- Quality tier: silver
- Public page: https://skillstore.pages.dev/skills/microsoft-azure-rbac
- Manifest: https://skillstore.pages.dev/api/skills/microsoft-azure-rbac/manifest

## Capabilities

- Finds a minimal built-in Azure role for requested permissions.
- Recommends a custom role when no built-in role matches.
- Generates Azure CLI commands for role assignments.
- Produces Bicep guidance for role assignment resources.
- Explains which roles can grant Azure RBAC access.

## Use Cases

- Grant Storage Read Access: Identify the minimal role for an application that only reads blobs at a defined scope.
- Automate Role Assignments: Prepare Azure CLI and Bicep assignments for managed identities in repeatable infrastructure deployments.
- Design a Custom Role: Define limited permissions when available built-in roles grant more access than required.

## Prompt Templates

### Find a Built-In Role

```
Find the least-privileged Azure role that lets [identity] perform [actions] on [resource scope]. Explain why it fits.
```

### Prepare an Azure CLI Assignment

```
Recommend the minimal role for [identity] at [scope], then prepare the Azure CLI assignment command.
```

### Create a Bicep Assignment

```
Create Bicep guidance assigning the least-privileged role to [principal] at [scope]. Include required identifiers and dependencies.
```

### Design a Custom Role Workflow

```
Compare built-in roles for [required actions]. If none fit, define a minimal custom role and provide CLI and Bicep assignment guidance.
```

## Limitations

- Requires access to the referenced Azure documentation and generation tools.
- Does not verify the current Azure tenant, identity, scope, or assignments.
- Generated commands and Bicep require review before deployment.
- Does not execute role assignments or confirm deployment results.

## Best Practices

- Use the narrowest practical assignment scope.
- Confirm required actions before selecting a role.
- Review generated commands and Bicep through normal change controls.

## Anti Patterns

- Do not assign Owner when a narrower role meets the requirement.
- Do not create a custom role before checking built-in roles.
- Do not deploy generated assignments without validating identity and scope identifiers.

## Security Audit

- Audited at: 2026-07-23T19:16:51.225\+00:00
- Summary: Both static findings are false positives caused by Markdown inline-code delimiters around an Azure permission name. The skill contains no executable shell or Ruby command at those locations.

## Stats

- Views: 117
- Downloads: 11
- Favorites: 0
- Popularity score: 0