# Azure Rbac

> Finds the least-privilege Azure RBAC role for an identity, generates CLI commands and Bicep code to assign it, and provides guidance on permissions needed to grant roles.

- Skill: `microsoft/azure-rbac` (Agent Skill)
- Install (CLI): `npx skillmds@latest add microsoft/azure-rbac`
- Raw SKILL.md: https://api.skillmd.com/api/skills/microsoft/azure-rbac/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra, Security, Cloud Platforms, Compliance & Privacy, Infrastructure as Code
- Tags: Azure, Bicep, Cli, Identity, Least Privilege, Rbac, Role Assignment
- License: MIT
- Author: Microsoft (https://skillmd.com/u/microsoft), verified publisher
- Updated: 2026-07-06
- Page: https://skillmd.com/skills/microsoft/azure-rbac

---

Use the 'azure__documentation' tool to find the minimal role definition that matches the desired permissions the user wants to assign to an identity. If no built-in role matches the desired permissions, use the 'azure__extension_cli_generate' tool to create a custom role definition with the desired permissions. Then use the 'azure__extension_cli_generate' tool to generate the CLI commands needed to assign that role to the identity. Finally, use the 'azure__bicepschema' and 'azure__get_azure_bestpractices' tools to provide a Bicep code snippet for adding the role assignment. If user is asking about role necessary to set access, refer to Prerequisites for Granting Roles down below:

## Prerequisites for Granting Roles

To assign RBAC roles to identities, you need a role that includes the `Microsoft.Authorization/roleAssignments/write` permission. The most common roles with this permission are:

- **User Access Administrator** (least privilege - recommended for role assignment only)
- **Owner** (full access including role assignment)
- **Custom Role** with `Microsoft.Authorization/roleAssignments/write`