A custom role grants a deliberately selected set of permissions to users or other identities. In Azure RBAC, it supports least-privilege access when built-in roles provide too much access or require combining several roles. section 2.0 section 2.4
Create and assign a custom role with these steps:
- Choose the smallest required permission set, such as reading virtual machines and restarting them without permitting creation or deletion. section 2.4
- Define the role in JSON. Put control-plane operations in Actions and NotActions, data-plane operations in DataActions and NotDataActions, and permitted scopes in AssignableScopes. section 2.5
- Upload the JSON file to Azure Cloud Shell, then run az role definition create --role-definition customRoleDefinition.json. section 2.5
- Assign the resulting role with az role assignment create, specifying the assignee, role name, and subscription or other supported scope. section 2.5
Restart Virtual Machines
A role can allow reading virtual machines plus start and restart actions at a subscription scope, while leaving NotActions, DataActions, and NotDataActions empty. Assign it to Bob without granting broader built-in roles. section 2.4
{ "Name": "Restart Virtual Machines", "IsCustom": true, "Description": "Restart Virtual Machines.", "Actions": [ "Microsoft.Compute/virtualMachines/read", "Microsoft.Compute/virtualMachines/start/action", "Microsoft.Compute/virtualMachines/restart/action", "Microsoft.Resources/subscriptions/resourceGroups/read" ], "NotActions": [ ], "DataActions": [ ], "NotDataActions": [ ], "AssignableScopes": [ "/subscriptions/00000000-0000-0000-0000-000000000000" ] }
Inspect the complete JSON definition, including its actions, empty exclusions, and subscription-level assignable scope. section 2.5
