What problem does it solve? Azure RBAC misconfiguration is a leading cause of production incidents: engineers grant Owner expecting blob access, omit principalType in Bicep causing intermittent failures, or hit the 4,000 assignment limit per subscription. This Skill provides the correct patterns for assigning roles, separating control plane from data plane access, and wiring up passwordless authentication. ## Core Features & Use Cases - Role Assignment Patterns: Built-in role catalog with GUIDs, scope hierarchy rules, and hard limits (4,000 per subscription, 5,000 custom roles per tenant). - Control Plane vs Data Plane Guidance: Explains why Owner cannot read blobs and which data plane roles (Storage Blob Data Contributor, Key Vault Secrets User, Cosmos DB built-in roles) to pair with management roles. - IaC Templates: Bicep and Terraform patterns for role assignments, custom role definitions, and reusable modules with deterministic GUID naming. - Zero-Credential Authentication: Managed identity setup, AKS Workload Identity, and GitHub Actions OIDC federation without stored secrets. - Use Case: A DevOps engineer needs a GitHub Actions workflow to deploy to AKS and read Key Vault secrets. The Skill provides the federated credential subject format, the exact role assignments (AcrPush, AKS Cluster User, Key Vault Secrets User), and the Bicep to provision them. ## Quick Start Ask how to grant a managed identity read access to blobs in a storage account using Bicep, including the correct data plane role and principalType setting.
