Role configuration defines the permissions an identity can perform on Azure resources. A role definition answers “what” in authorization, while scope identifies where those permissions apply. section 2.3.2
Use role definitions to shape access deliberately:
- Select a built-in role when its predefined permissions match a specific operational task. section 2.3.2
- Create a custom role when users need a granular permission set that existing roles do not provide. section 2.4
- Group the required actions into one role instead of combining several roles that could overpermission users. section 2.4
- Treat the role definition as one part of authorization: a role assignment grants it to a security principal at a resource scope. section 2.3.3
Restrict virtual machine operations
A custom role can allow users to restart virtual machines without allowing them to create or delete virtual machines. This concentrates the required permissions in one role and supports least privilege. section 2.4
az role definition list --name "Virtual Machine Contributor"
Inspect a built-in role definition with Azure CLI to review its description, assignable scopes, and permissions before using or adapting it. section 2.3.2
