azure-rbac

Identify minimal Azure RBAC roles and generate CLI and Bicep assignment commands.

66|41|Updated Mar 4, 2026
One-click install
npx skills add https://github.com/olivomarco/vbd-copilot --skill azure-rbac-olivomarco
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: azure-rbac
Source: https://github.com/olivomarco/vbd-copilot/tree/main/skills/azure-rbac
Command: npx skills add https://github.com/olivomarco/vbd-copilot --skill azure-rbac-olivomarco

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Assigning the correct Azure RBAC role to an identity with least privilege can be error-prone and time-consuming. This Skill identifies the minimal built-in role that matches the requested permissions and provides ready-to-use CLI commands and a Bicep snippet to apply the assignment, ensuring security and compliance.

Core Features & Use Cases

  • Role discovery: maps requested permissions to the most restrictive built-in role or a custom role when needed.
  • Automation artifacts: outputs CLI commands for role assignment and a Bicep snippet for IaC-based provisioning.
  • Guidance & prerequisites: explains prerequisites for granting roles and how to verify permissions.

Quick Start

Ask to grant access to an identity with the least-privilege role and receive the necessary CLI and Bicep outputs.

Frequently Asked Questions about azure-rbac

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find the least-privilege Azure RBAC role for an identity?

To find the least-privilege Azure RBAC role, map the requested permissions to the most restrictive built-in role, or define a custom role when built-in options exceed the required access scope. This ensures security and compliance.

How do I assign an Azure RBAC role using Bicep and CLI?

Assign an Azure RBAC role by generating ready-to-use CLI commands and a Bicep snippet from the identified least-privilege role, allowing you to apply the assignment directly across subscriptions, resources, and service principals.

When do I need a custom Azure RBAC role definition instead of a built-in role?

You need a custom Azure RBAC role definition when no built-in role matches your exact permission requirements, allowing you to enforce strict least-privilege access without granting unnecessary broad permissions.

Can I use Bicep to provision role assignments for Azure service principals?

Yes, you can use Bicep to provision role assignments for Azure service principals by outputting an Infrastructure as Code snippet that defines the least-privilege role mapping for automated deployment.

What are the prerequisites for granting Azure RBAC roles via CLI?

Prerequisites for granting Azure RBAC roles via CLI include having sufficient administrative permissions to manage access and verifying the target identity's configuration before applying the least-privilege role assignment.