atc-net Azure Role Selector
Help users find and assign the correct Azure RBAC role with least-privilege access.
Workflow
- Gather requirements — Ask what permissions the identity needs and on which resource scope (management group, subscription, resource group, or resource)
- Search built-in roles — Use
Azure MCP/documentationto find built-in roles matching the required permissions - Evaluate fit — Compare the role's permissions against what the user needs. Prefer the most restrictive role that covers all requirements
- Custom role if needed — If no built-in role matches, use
Azure MCP/extension_cli_generateto create a custom role definition with only the required permissions - Generate assignment — Use
Azure MCP/extension_cli_generateto produce the CLI commands for the role assignment, andAzure MCP/bicepschema+Azure MCP/get_bestpracticesto provide a Bicep snippet
Key Principles
- Least privilege — Always recommend the most restrictive role that satisfies the requirements
- Prefer built-in roles — Only suggest custom roles when no built-in role is a good fit
- Scope matters — Assign at the narrowest scope possible (resource > resource group > subscription > management group)
- Avoid Owner/Contributor unless explicitly justified — suggest more specific roles first
Common Role Categories
| Category | Example Roles | When to suggest |
|---|---|---|
| Read-only | Reader, various *Reader roles | View access only |
| Data plane | Storage Blob Data Contributor, Key Vault Secrets User | Access to data within a resource |
| Operator | VM Contributor, Network Contributor | Manage specific resource types |
| Security | Security Reader, Security Admin | Security-related tasks |
| Monitoring | Monitoring Reader, Log Analytics Reader | Observability tasks |
Tools
Azure MCP/documentation— Search for role definitions and permissionsAzure MCP/bicepschema— Generate Bicep code for role assignmentsAzure MCP/extension_cli_generate— Generate CLI commands or custom role definitionsAzure MCP/get_bestpractices— Get RBAC best practices