azure-rbac

Expert knowledge for Azure Role-based access control development including troubleshooting, best practices, decision making, limits & quotas, security, configuration, and integrations & coding patterns. Use when building, debugging, or optimizing Azure Role-based access control applications. Not for Azure Policy (use azure-policy), Azure Resource Manager (use azure-resource-manager), Azure Security (use azure-security), Azure Lighthouse (use azure-lighthouse).

Safety Notice

This listing is imported from skills.sh public index metadata. Review upstream SKILL.md and repository scripts before running.

Copy this and send it to your AI assistant to learn

Install skill "azure-rbac" with this command: npx skills add microsoftdocs/agent-skills/microsoftdocs-agent-skills-azure-rbac

Azure Role-based access control Skill

This skill provides expert guidance for Azure Role-based access control. Covers troubleshooting, best practices, decision making, limits & quotas, security, configuration, and integrations & coding patterns. It combines local quick-reference content with remote documentation fetching capabilities.

How to Use This Skill

IMPORTANT for Agent: This file may be large. Use the Category Index below to locate relevant sections, then use read_file with specific line ranges (e.g., L136-L144) to read the sections needed for the user's question

IMPORTANT for Agent: If metadata.generated_at is more than 3 months old, suggest the user pull the latest version from the repository. If mcp_microsoftdocs tools are not available, suggest the user install it: Installation Guide

This skill requires network access to fetch documentation content:

  • Preferred: Use mcp_microsoftdocs:microsoft_docs_fetch with query string from=learn-agent-skill. Returns Markdown.
  • Fallback: Use fetch_webpage with query string from=learn-agent-skill&accept=text/markdown. Returns Markdown.

Category Index

CategoryLinesDescription
TroubleshootingL35-L43Diagnosing and fixing Azure RBAC issues: access denials, role/condition misconfigurations, role limit errors, and auditing role/condition changes via Activity Log
Best PracticesL44-L50Security-focused guidance on designing Azure RBAC: choosing scopes, delegating access with ABAC conditions, and applying least privilege and separation-of-duties best practices.
Decision MakingL51-L58Guidance on choosing and migrating role models: moving from classic admins to RBAC, scaling with ABAC, selecting Azure vs Entra vs classic roles, and transferring subscriptions between directories.
Limits & QuotasL59-L64Designing and managing Azure RBAC custom roles, including understanding role structure, permissions, and step-by-step creation using the Azure portal
SecurityL65-L129Managing and securing Azure RBAC: built‑in security roles, deny assignments, conditional/ABAC access, PIM, privileged access alerts, and policy-based RBAC governance.
ConfigurationL130-L141Configuring Azure RBAC/ABAC: prerequisites, condition syntax, role assignments, built‑in vs custom roles, and creating/inspecting custom role definitions via CLI and PowerShell
Integrations & Coding PatternsL142-L158How to assign, list, and query Azure RBAC role assignments using portal, CLI, PowerShell, Bicep/ARM templates, REST API, and managed identities

Troubleshooting

TopicURL
Audit Azure RBAC changes using Activity Loghttps://learn.microsoft.com/en-us/azure/role-based-access-control/change-history-report
Resolve common issues with Azure RBAC conditionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-faq
Troubleshoot Azure RBAC role assignment conditionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-troubleshoot
Resolve Azure RBAC role and custom role limit issueshttps://learn.microsoft.com/en-us/azure/role-based-access-control/troubleshoot-limits
Troubleshoot common Azure RBAC access issueshttps://learn.microsoft.com/en-us/azure/role-based-access-control/troubleshooting

Best Practices

TopicURL
Apply security-focused best practices for Azure RBAChttps://learn.microsoft.com/en-us/azure/role-based-access-control/best-practices
Example patterns for delegating RBAC with ABAC conditionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/delegate-role-assignments-examples
Choose appropriate Azure RBAC scopes for accesshttps://learn.microsoft.com/en-us/azure/role-based-access-control/scope-overview

Decision Making

TopicURL
Migrate from Azure classic administrators to RBAChttps://learn.microsoft.com/en-us/azure/role-based-access-control/classic-administrators
Scale Azure RBAC assignments using ABAC and attributeshttps://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-custom-security-attributes-example
Choose between Azure, Entra, and classic admin roleshttps://learn.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles
Transfer Azure subscriptions between Entra directorieshttps://learn.microsoft.com/en-us/azure/role-based-access-control/transfer-subscription

Limits & Quotas

TopicURL
Understand and configure Azure RBAC custom roleshttps://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles
Create Azure custom roles in the portalhttps://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles-portal

Security

TopicURL
Reference for all Azure RBAC built-in roleshttps://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles
Azure RBAC AI and ML built-in roles referencehttps://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/ai-machine-learning
Azure RBAC analytics built-in roles referencehttps://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/analytics
Azure RBAC compute built-in roles referencehttps://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/compute
Azure RBAC containers built-in roles referencehttps://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/containers
Azure RBAC databases built-in roles referencehttps://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/databases
Azure RBAC DevOps built-in roles referencehttps://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/devops
Azure RBAC general built-in roles referencehttps://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/general
Use hybrid and multicloud RBAC built-in roleshttps://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/hybrid-multicloud
Azure RBAC identity built-in roles referencehttps://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/identity
Azure RBAC integration built-in roles referencehttps://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/integration
Azure RBAC IoT built-in roles referencehttps://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/internet-of-things
Apply management and governance RBAC built-in roleshttps://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/management-and-governance
Use Azure RBAC built-in roles for migration taskshttps://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/migration
Assign Azure RBAC built-in roles for monitoringhttps://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/monitor
Azure RBAC networking built-in roles referencehttps://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/networking
Azure RBAC privileged built-in roles referencehttps://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/privileged
Azure RBAC security built-in roles referencehttps://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/security
Azure RBAC storage built-in roles referencehttps://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/storage
Azure RBAC web and mobile built-in roles referencehttps://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/web-and-mobile
Restrict blob read access using tags and ABAChttps://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-custom-security-attributes
Manage Azure RBAC conditions using Azure CLIhttps://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-role-assignments-cli
Configure Azure RBAC role assignment conditions in portalhttps://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-role-assignments-portal
Manage Azure RBAC conditions using PowerShellhttps://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-role-assignments-powershell
Manage Azure RBAC conditions via REST APIhttps://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-role-assignments-rest
Define Azure RBAC conditions in ARM templateshttps://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-role-assignments-template
Define Azure custom roles using Bicephttps://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles-bicep
Manage Azure custom roles using Azure CLIhttps://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles-cli
Manage Azure custom roles using PowerShellhttps://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles-powershell
Manage Azure custom roles via REST APIhttps://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles-rest
Define Azure custom roles with ARM templateshttps://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles-template
Delegate Azure RBAC role assignment management securelyhttps://learn.microsoft.com/en-us/azure/role-based-access-control/delegate-role-assignments-overview
Delegate Azure RBAC role management with ABAC conditionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/delegate-role-assignments-portal
List and understand Azure RBAC deny assignmentshttps://learn.microsoft.com/en-us/azure/role-based-access-control/deny-assignments
Elevate Global Administrator access to all subscriptionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin
Use AI and machine learning RBAC permissionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/ai-machine-learning
Use Analytics category Azure RBAC permissionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/analytics
Use Compute category Azure RBAC permissionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/compute
Use Containers category Azure RBAC permissionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/containers
Use Databases category Azure RBAC permissionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/databases
Use DevOps category Azure RBAC permissionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/devops
Use General category Azure RBAC permissionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/general
Use hybrid and multicloud RBAC permissionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/hybrid-multicloud
Use Identity category Azure RBAC permissionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/identity
Use Integration category Azure RBAC permissionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/integration
Use IoT category Azure RBAC permissionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/internet-of-things
Use management and governance RBAC permissionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/management-and-governance
Use Migration category Azure RBAC permissionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/migration
Use Monitor category Azure RBAC permissionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/monitor
Use Networking category Azure RBAC permissionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/networking
Use Security category Azure RBAC permissionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/security
Use Storage category Azure RBAC permissionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/storage
Use Web and Mobile Azure RBAC permissionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/web-and-mobile
Use PIM for eligible and time-bound Azure RBAC roleshttps://learn.microsoft.com/en-us/azure/role-based-access-control/pim-integration
Apply Azure RBAC built-in policy definitionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/policy-reference
Reference Azure resource provider permission operationshttps://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Alert on privileged Azure RBAC role assignmentshttps://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-alert
Activate eligible Azure RBAC roles in the portalhttps://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-eligible-activate
Grant Azure RBAC access to external B2B usershttps://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-external-users
Assign subscription Owner with constrained RBAC conditionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal-subscription-admin
Apply Azure Policy compliance controls to Azure RBAChttps://learn.microsoft.com/en-us/azure/role-based-access-control/security-controls-policy

Configuration

TopicURL
Use actions and attributes in Azure ABAC conditionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-authorization-actions-attributes
Author Azure RBAC condition expressions and syntaxhttps://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-format
Meet prerequisites to use Azure RBAC conditionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-prerequisites
Configure and interpret Azure RBAC role assignmentshttps://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments
Understand and configure Azure RBAC role definitionshttps://learn.microsoft.com/en-us/azure/role-based-access-control/role-definitions
List and inspect Azure built-in and custom RBAC roleshttps://learn.microsoft.com/en-us/azure/role-based-access-control/role-definitions-list
Create Azure custom RBAC roles using Azure CLIhttps://learn.microsoft.com/en-us/azure/role-based-access-control/tutorial-custom-role-cli
Define Azure custom RBAC roles with PowerShellhttps://learn.microsoft.com/en-us/azure/role-based-access-control/tutorial-custom-role-powershell

Integrations & Coding Patterns

TopicURL
Assign Azure RBAC roles using Bicep templateshttps://learn.microsoft.com/en-us/azure/role-based-access-control/quickstart-role-assignments-bicep
Assign Azure RBAC roles with ARM templateshttps://learn.microsoft.com/en-us/azure/role-based-access-control/quickstart-role-assignments-template
Assign Azure RBAC roles using Azure CLIhttps://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-cli
List Azure RBAC role assignments via Azure CLIhttps://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-list-cli
View Azure RBAC role assignments in the portalhttps://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-list-portal
List Azure RBAC role assignments using PowerShellhttps://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-list-powershell
Query Azure RBAC role assignments using REST APIhttps://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-list-rest
Assign Azure RBAC roles using the Azure portalhttps://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal
Assign Azure RBAC roles starting from a managed identityhttps://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal-managed-identity
Assign Azure RBAC roles via PowerShell for all principalshttps://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-powershell
Assign Azure RBAC roles through the REST APIhttps://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-rest
Assign Azure RBAC roles using ARM templateshttps://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-template
Grant group-based Azure RBAC access via PowerShellhttps://learn.microsoft.com/en-us/azure/role-based-access-control/tutorial-role-assignments-group-powershell
Grant Azure RBAC access using PowerShell commandshttps://learn.microsoft.com/en-us/azure/role-based-access-control/tutorial-role-assignments-user-powershell

Source Transparency

This detail page is rendered from real SKILL.md content. Trust labels are metadata-based hints, not a safety guarantee.

Open in GitHubOpen in ClawHub

Related Skills

Related by shared tags or category signals.

Security

azure-security

No summary provided by upstream source.

Repository SourceNeeds Review
7-microsoftdocs
Automation

azure-architecture

No summary provided by upstream source.

Repository SourceNeeds Review
10-microsoftdocs
Automation

azure-logic-apps

No summary provided by upstream source.

Repository SourceNeeds Review
8-microsoftdocs
Automation

azure-blob-storage

No summary provided by upstream source.

Repository SourceNeeds Review
8-microsoftdocs