Azure Role Selector
Purpose
Select the narrowest Azure role and assignment scope that satisfies the requested access without defaulting to broad standing privilege.
When to use
Use this skill when the user needs to:
- map requested Azure operations to a role,
- grant minimum access to a user, group, service principal, managed identity, or workload identity,
- decide whether a built-in role is enough,
- separate control-plane permissions from data-plane permissions,
- decide whether a custom role is justified,
- choose the safest assignment scope and validation path.
Do not use this skill for tenant-wide governance design, access review programs, or broad RBAC posture critique. Route those asks toward techtide-azure-rbac-review or a governance-focused skill.
Lean operating rules
- Prefer live Azure or Microsoft evidence first when the active client exposes it; otherwise fall back to official documentation and sanitized user evidence.
- Separate confirmed facts from inference. If state was not queried or shown, say so.
- Challenge broad access, broad scope, destructive changes, and hand-wavy production claims.
- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
References
Load these only when needed:
- MCP and evidence path - use when choosing live Azure evidence, confirming Microsoft MCP capability, or switching to documentation mode.
- Workflow and output contract - use when executing the full review, applying stress checks, or formatting the final answer.
- Official sources - use when you need the detailed Microsoft documentation list or source notes.
Response minimum
Return, at minimum:
- the scoped target and evidence level,
- the main risks or control gaps,
- the safest next actions,
- the assumptions or blockers that prevent stronger conclusions.
1---2name: techtide-azure-role-selector3description: Use this skill when the user asks which Azure role to assign, how to grant minimum access, whether a built-in role is sufficient, or when a custom role may be required.4---56# Azure Role Selector78## Purpose910Select the narrowest Azure role and assignment scope that satisfies the requested access without defaulting to broad standing privilege.1112## When to use1314Use this skill when the user needs to:1516- map requested Azure operations to a role,17- grant minimum access to a user, group, service principal, managed identity, or workload identity,18- decide whether a built-in role is enough,19- separate control-plane permissions from data-plane permissions,20- decide whether a custom role is justified,21- choose the safest assignment scope and validation path.2223Do not use this skill for tenant-wide governance design, access review programs, or broad RBAC posture critique. Route those asks toward `techtide-azure-rbac-review` or a governance-focused skill.2425## Lean operating rules2627- Prefer live Azure or Microsoft evidence first when the active client exposes it; otherwise fall back to official documentation and sanitized user evidence.28- Separate confirmed facts from inference. If state was not queried or shown, say so.29- Challenge broad access, broad scope, destructive changes, and hand-wavy production claims.30- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.3132## References3334Load these only when needed:3536- [MCP and evidence path](references/mcp-and-evidence.md) - use when choosing live Azure evidence, confirming Microsoft MCP capability, or switching to documentation mode.37- [Workflow and output contract](references/workflow-and-output.md) - use when executing the full review, applying stress checks, or formatting the final answer.38- [Official sources](references/official-sources.md) - use when you need the detailed Microsoft documentation list or source notes.3940## Response minimum4142Return, at minimum:4344- the scoped target and evidence level,45- the main risks or control gaps,46- the safest next actions,47- the assumptions or blockers that prevent stronger conclusions.
TechTideOhio