Azure Role Selector

This skill helps you choose the right Azure RBAC (Role-Based Access Control) roles and implement least-privilege access patterns for applications and users.

When to Use This Skill

Use this skill when you need to:
- Select appropriate Azure built-in roles for specific scenarios
- Create custom RBAC role definitions
- Implement least-privilege access for applications
- Configure role assignments at correct scopes
- Set up Managed Identity with proper permissions
- Audit and review existing role assignments

Capabilities

• Recommend Azure built-in roles for common scenarios
• Guide custom role definition creation
• Analyze permission requirements
• Configure role assignments at appropriate scopes (subscription, resource group, resource)
• Implement Managed Identity authentication
• Provide security best practices for RBAC

Prerequisites

• Azure subscription
• Understanding of Azure resource hierarchy
• Permissions to manage RBAC (User Access Administrator or Owner role)
• Knowledge of application requirements

Common Built-in Roles

General Roles

Data Access Roles

Storage

• Storage Blob Data Contributor: Read/write/delete blobs
• Storage Blob Data Reader: Read-only blob access
• Storage Queue Data Contributor: Read/write/delete queue messages
• Storage Table Data Contributor: Read/write/delete table data

Databases

• SQL DB Contributor: Manage SQL databases (not data access)
• Cosmos DB Account Reader Role: Read Cosmos DB metadata
• Redis Cache Contributor: Manage Redis caches

Security Roles

• Key Vault Secrets User: Read secret values (recommended)
• Key Vault Secrets Officer: Manage secrets lifecycle
• Key Vault Crypto User: Cryptographic operations
• Security Reader: View security recommendations

Application Roles

• Website Contributor: Manage web apps
• Web Plan Contributor: Manage App Service plans
• Logic App Contributor: Manage Logic Apps
• Function App Contributor: Manage Function Apps

Monitoring Roles

• Monitoring Reader: Read monitoring data
• Monitoring Contributor: Manage monitoring configuration
• Log Analytics Reader: Query logs
• Application Insights Component Contributor: Manage Application Insights

Quick Start Guide

Step 1: Identify Required Permissions

# List all operations for a service
az provider operation show --namespace Microsoft.Storage

# Search for specific permissions
az provider operation show --namespace Microsoft.KeyVault | grep "secrets/read"

Step 2: Find Matching Built-in Role

# List all built-in roles
az role definition list --output table

# Search by name
az role definition list --name "*Storage Blob*" --output table

# Get detailed role permissions
az role definition list --name "Storage Blob Data Reader" --output json

Step 3: Assign Role at Proper Scope

# Resource-level (most restrictive - RECOMMENDED)
az role assignment create \
  --assignee <principal-id> \
  --role "Storage Blob Data Reader" \
  --scope "/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.Storage/storageAccounts/<account>"

# Resource Group-level
az role assignment create \
  --assignee <principal-id> \
  --role "Storage Blob Data Reader" \
  --scope "/subscriptions/<sub-id>/resourceGroups/<rg>"

# Subscription-level (least restrictive - use sparingly)
az role assignment create \
  --assignee <principal-id> \
  --role "Storage Blob Data Reader" \
  --scope "/subscriptions/<sub-id>"

Common Scenarios

Scenario 1: App Service Reading from Key Vault

Requirements: App needs to read secrets from Key Vault

Solution:

# Enable Managed Identity
az webapp identity assign \
  --name myapp \
  --resource-group myrg

# Get principal ID
PRINCIPAL_ID=$(az webapp identity show \
  --name myapp \
  --resource-group myrg \
  --query principalId -o tsv)

# Assign role at Key Vault scope
az role assignment create \
  --assignee $PRINCIPAL_ID \
  --role "Key Vault Secrets User" \
  --scope "/subscriptions/<sub-id>/resourceGroups/myrg/providers/Microsoft.KeyVault/vaults/mykeyvault"

Scenario 2: Function App Writing to Blob Storage

Requirements: Function needs to create and update blobs

Solution:

# Enable Managed Identity on Function App
az functionapp identity assign \
  --name myfunc \
  --resource-group myrg

# Get principal ID
PRINCIPAL_ID=$(az functionapp identity show \
  --name myfunc \
  --resource-group myrg \
  --query principalId -o tsv)

# Assign role at storage account scope
az role assignment create \
  --assignee $PRINCIPAL_ID \
  --role "Storage Blob Data Contributor" \
  --scope "/subscriptions/<sub-id>/resourceGroups/myrg/providers/Microsoft.Storage/storageAccounts/mystorage"

Scenario 3: CI/CD Pipeline Deploying Resources

Requirements: GitHub Actions deploying to resource group

Solution:

# Create service principal
az ad sp create-for-rbac \
  --name "github-actions-deploy" \
  --role Contributor \
  --scopes "/subscriptions/<sub-id>/resourceGroups/myrg" \
  --sdk-auth

# Note: Limit to resource group, not subscription
# Use the output JSON in GitHub Secrets

Scenario 4: Read-Only Access for Auditing

Requirements: Security team needs view access

Solution:

# Assign Reader role at subscription level
az role assignment create \
  --assignee <user-principal-name> \
  --role "Reader" \
  --scope "/subscriptions/<sub-id>"

# Plus Security Reader for security insights
az role assignment create \
  --assignee <user-principal-name> \
  --role "Security Reader" \
  --scope "/subscriptions/<sub-id>"

Custom Role Creation

When built-in roles are too broad:

Example: Custom Storage Reader for Specific Container

{
  "Name": "Custom Container Reader",
  "IsCustom": true,
  "Description": "Read-only access to specific blob containers",
  "Actions": [
    "Microsoft.Storage/storageAccounts/blobServices/containers/read"
  ],
  "NotActions": [],
  "DataActions": [
    "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
  ],
  "NotDataActions": [],
  "AssignableScopes": [
    "/subscriptions/<subscription-id>/resourceGroups/<resource-group>"
  ]
}

Create the role:

az role definition create --role-definition custom-role.json

Example: Custom Deployment Role

{
  "Name": "App Deployer",
  "IsCustom": true,
  "Description": "Deploy web apps but cannot delete",
  "Actions": [
    "Microsoft.Web/sites/write",
    "Microsoft.Web/sites/config/write",
    "Microsoft.Web/sites/restart/action",
    "Microsoft.Web/sites/read"
  ],
  "NotActions": [
    "Microsoft.Web/sites/delete"
  ],
  "DataActions": [],
  "NotDataActions": [],
  "AssignableScopes": [
    "/subscriptions/<subscription-id>"
  ]
}

Decision Matrix

Best Practices

Principle of Least Privilege

1. Start minimal: Begin with most restrictive role
2. Use resource-level scope: Avoid subscription-wide assignments
3. Prefer built-in roles: Easier to maintain
4. Use Managed Identity: Eliminates credential management
5. Regular reviews: Remove unused permissions quarterly
6. Separate duties: Different roles for different functions

Security Hardening

• Enable Conditional Access for privileged roles
• Use Privileged Identity Management (PIM) for just-in-time access
• Implement approval workflows for sensitive role assignments
• Audit regularly: Review role assignments monthly
• Use Azure Policy: Enforce RBAC standards
• Create break-glass accounts: For emergency access

Monitoring and Auditing

# List all role assignments for a principal
az role assignment list \
  --assignee <principal-id> \
  --all \
  --output table

# List assignments in a resource group
az role assignment list \
  --resource-group myrg \
  --output table

# Check effective permissions
az role assignment list \
  --assignee <principal-id> \
  --scope <scope> \
  --include-inherited

Troubleshooting

Issue: "Insufficient Privileges" Error

Causes:
- Missing role assignment
- Wrong scope
- Permissions not propagated (wait 30 min)
- Managed Identity not enabled

Solutions:

# Verify role assignment exists
az role assignment list --assignee <principal-id>

# Check if Managed Identity is enabled
az webapp identity show --name myapp --resource-group myrg

# Verify scope matches resource
az role assignment list --scope <full-resource-id>

Issue: Too Many Permissions

Analysis:

# Get all permissions for a principal
az role assignment list --assignee <principal-id> --all

# Review actual permissions used (check Azure Advisor)

Resolution:
1. Create custom role with only required actions
2. Reduce scope to specific resources
3. Remove unnecessary role assignments

Issue: Cannot Assign Roles

Causes:
- Lack User Access Administrator or Owner role
- Subscription has restrictions
- Role assignment quota exceeded

Solutions:

# Check your permissions
az role assignment list --assignee <your-principal-id>

# Verify you can assign roles
az role definition list --name "User Access Administrator"

Security Considerations

• Never use Owner for applications - Use Contributor instead
• Avoid wildcard permissions in custom roles
• Rotate service principal credentials (or use Managed Identity)
• Monitor privileged assignments with Azure Monitor alerts
• Use groups for users - Assign roles to groups, not individuals
• Document all assignments - Maintain an RBAC registry
• Implement approval process for production role assignments

PowerShell Helper Scripts

Analyze Managed Identity Permissions

param([string]$ResourceName, [string]$ResourceGroup)

$identity = az webapp identity show `
    --name $ResourceName `
    --resource-group $ResourceGroup | ConvertFrom-Json

$assignments = az role assignment list `
    --assignee $identity.principalId `
    --all | ConvertFrom-Json

Write-Host "Managed Identity Permissions for $ResourceName"
Write-Host "Principal ID: $($identity.principalId)"
Write-Host ""

foreach ($assignment in $assignments) {
    Write-Host "Role: $($assignment.roleDefinitionName)"
    Write-Host "Scope: $($assignment.scope)"
    Write-Host ""
}

References

• Azure Built-in Roles
• Custom Roles
• Managed Identities
• RBAC Best Practices
• Azure AD PIM
• Zero Trust Security