azure-rbac

Identify minimal Azure RBAC roles and generate CLI and Bicep assignment commands.

66|41|Updated Mar 4, 2026
One-click install
npx skills add https://github.com/olivomarco/vbd-copilot --skill azure-rbac-olivomarco
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: azure-rbac
Source: https://github.com/olivomarco/vbd-copilot/tree/main/skills/azure-rbac
Command: npx skills add https://github.com/olivomarco/vbd-copilot --skill azure-rbac-olivomarco

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Assigning the correct Azure RBAC role to an identity with least privilege can be error-prone and time-consuming. This Skill identifies the minimal built-in role that matches the requested permissions and provides ready-to-use CLI commands and a Bicep snippet to apply the assignment, ensuring security and compliance.

Core Features & Use Cases

  • Role discovery: maps requested permissions to the most restrictive built-in role or a custom role when needed.
  • Automation artifacts: outputs CLI commands for role assignment and a Bicep snippet for IaC-based provisioning.
  • Guidance & prerequisites: explains prerequisites for granting roles and how to verify permissions.

Quick Start

Ask to grant access to an identity with the least-privilege role and receive the necessary CLI and Bicep outputs.

Frequently Asked Questions about azure-rbac

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find the least-privilege Azure RBAC role for an identity?▼

To find the least-privilege Azure RBAC role, map the requested permissions to the most restrictive built-in role, or define a custom role when built-in options exceed the required access scope. This ensures security and compliance.

How do I assign an Azure RBAC role using Bicep and CLI?▼

Assign an Azure RBAC role by generating ready-to-use CLI commands and a Bicep snippet from the identified least-privilege role, allowing you to apply the assignment directly across subscriptions, resources, and service principals.

When do I need a custom Azure RBAC role definition instead of a built-in role?▼

You need a custom Azure RBAC role definition when no built-in role matches your exact permission requirements, allowing you to enforce strict least-privilege access without granting unnecessary broad permissions.

Can I use Bicep to provision role assignments for Azure service principals?▼

Yes, you can use Bicep to provision role assignments for Azure service principals by outputting an Infrastructure as Code snippet that defines the least-privilege role mapping for automated deployment.

What are the prerequisites for granting Azure RBAC roles via CLI?▼

Prerequisites for granting Azure RBAC roles via CLI include having sufficient administrative permissions to manage access and verifying the target identity's configuration before applying the least-privilege role assignment.