AutoGineer
Generated banner for Azure Role Selector
Generated logo for Azure Role Selector

Azure Role Selector

GitHubOfficialCreated by Microsoft CorporationDistributed by GitHub

  • Skill
  • Tool integration
  • Cloud and DevOps
  • MIT
  • No issues found
Download ZIP

From the author

When user is asking for guidance for which role to assign to an identity given desired permissions, this agent helps them understand the role that will meet the requirements with least privilege access and how to apply that role.
— the description by Microsoft Corporation

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The azure-role-selector skill provides guidance on selecting the most appropriate Azure role for a given set of permissions. By prioritizing the principle of least privilege, the agent evaluates built-in roles and, if necessary, assists in creating custom role definitions. It further supports the implementation process by generating the required Azure CLI commands and providing Bicep code snippets for infrastructure-as-code deployments.

What it does

  • Identifies the minimal built-in Azure role matching specific permission requirements.
  • Generates custom role definitions when no suitable built-in role exists.
  • Provides Azure CLI commands to assign roles to identities.
  • Supplies Bicep code snippets for automated role assignment.
  • Incorporates best practices for role-based access control in Azure environments.

When to use it

  • When you need to assign permissions to an Azure identity while adhering to least-privilege principles.
  • When you are unsure which built-in Azure role covers a specific set of actions.
  • When you need to define a custom role for unique permission requirements.
  • When you are preparing to implement role assignments via CLI or Bicep templates.

Advantages

  • Ensures security by enforcing the principle of least privilege.
  • Streamlines the selection process for complex Azure role definitions.
  • Reduces manual effort by generating ready-to-use CLI and Bicep code.
  • Promotes consistent and best-practice-aligned access management.

Usage examples

“I need to give a service principal read access to storage blobs but nothing else. Which role should I use?”
The agent identifies the Storage Blob Data Reader role, explains why it fits, and provides the CLI command and Bicep snippet to assign it.
“Create a custom role for a user who needs to restart virtual machines but not delete them.”
The agent generates a custom role definition JSON and the corresponding CLI commands to create and assign this role.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/github/azure-role-selector/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip azure-role-selector.zip -d .agents/skills

Documentation by Microsoft Corporation

Use 'Azure MCP/documentation' tool to find the minimal role definition that matches the desired permissions the user wants to assign to an identity (If no built-in role matches the desired permissions, use 'Azure MCP/extension_cli_generate' tool to create a custom role definition with the desired permissions). Use 'Azure MCP/extension_cli_generate' tool to generate the CLI commands needed to assign that role to the identity and use the 'Azure MCP/bicepschema' and the 'Azure MCP/get_bestpractices' tool to provide a Bicep code snippet for adding the role assignment.

Files

LICENSE.txt

MIT License

Copyright 2025 (c) Microsoft Corporation.

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE

Requirements and compatibility

Written for: GitHub Copilot

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Declares allowed tools

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
Microsoft Corporation
Publisher
GitHub (Official)
Distributed by
GitHub
Source
github/awesome-copilot · skills/azure-role-selector · commit 797337f
Licence
MIT License (redistribution allowed)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Microsoft Corporation or GitHub.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download azure-role-selector.zip