azure-role-selector

Least-privilege Azure role selection identifies the minimal built-in role matching your identity's required permissions. Provide the target service principal and permission list; the Skill proposes the appropriate role, outputs Azure CLI assignment commands, and generates Bicep templates for infrastructure deployment.

Least-privilege RBAC reduces access risk by assigning only necessary permissions. This Skill finds built-in Azure roles satisfying your requirements, guides custom role creation when no built-in fit exists, and generates CLI commands and Bicep snippets following best practices for role provisioning.

Yes. The Skill generates both Azure CLI commands to assign roles and Bicep templates for infrastructure-as-code deployment. Output includes role recommendations with best-practice guidance tailored to your identity type—service principals, user accounts, or managed identities.

When built-in roles don't satisfy your permission requirements, the Skill provides step-by-step guidance to define a custom role. It outputs the role definition structure and CLI commands needed to create and assign the custom role in your Azure environment.

The Skill applies to all Azure identity types: service principals, user accounts, and managed identities. It evaluates permissions for any identity and recommends the least-privilege role appropriate to your identity's provisioning, governance, or compliance context.

Least-privilege roles minimize access risk by limiting capabilities to exactly what's needed, reducing blast radius from compromised identities. This Skill automates discovery of minimal-permission roles and compliance-aligned guidance, supporting security and governance reviews.