azure-role-selector

Identify minimal Azure RBAC roles and generate CLI and Bicep assignments.

Updated Jan 1, 2026

Search Tags:#cli #azure #rbac #identity #bicep #least-privilege #role-definition

Ready to run

npx skills add https://github.com/Ditto190/modme-ui-01 --skill azure-role-selector-ditto190

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: azure-role-selector
Source: https://github.com/Ditto190/modme-ui-01/tree/main/agent-library/skills/azure-role-selector
Command: npx skills add https://github.com/Ditto190/modme-ui-01 --skill azure-role-selector-ditto190

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps users identify the minimal Azure role required to grant an identity the necessary permissions while applying the principle of least privilege.

Core Features & Use Cases

Role recommendation: Suggests built-in Azure roles that satisfy the requested permissions, or generates a custom role definition when needed.
CLI & IaC output: Produces the necessary CLI commands to assign the role and a Bicep snippet for infrastructure as code.
Guidance on scope: Considers resource scope (subscription, resource group, or specific resources) to ensure proper access.

Quick Start

Provide the desired permissions and target scope to the Skill. The Skill will output the recommended role and the corresponding CLI commands and Bicep snippet to apply the role.

Frequently Asked Questions about azure-role-selector

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find the least-privilege Azure RBAC role for specific permissions?▼

To find the least-privilege Azure RBAC role, provide your desired permissions and target scope. The tool recommends a built-in role or generates a custom role definition, outputting CLI commands and Bicep snippets for deployment.

What is the best way to assign Azure roles using Bicep and CLI?▼

The best way to assign Azure roles is by generating CLI commands and Bicep snippets directly from your required permissions. This ensures your IaC deployments apply the recommended least-privilege role accurately.

When do I need a custom Azure role definition instead of a built-in role?▼

You need a custom Azure role definition when existing built-in roles exceed your required permissions. This tool identifies permission-constrained scenarios and generates a custom role to enforce strict least-privilege access.

Can I apply Azure RBAC recommendations at different resource scopes?▼

Yes, you can apply Azure RBAC recommendations at subscription, resource group, or specific resource scopes. The tool evaluates your target scope to ensure proper access boundaries for the chosen identity.

Does least-privilege role planning work for both identities and resources in Azure?▼

Yes, least-privilege role planning works across Azure identities and resources. By evaluating requested permissions against the target scope, it recommends the exact built-in or custom role required.