Guide · Agent skill
How to use the Azure Role Selector agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The azure-role-selector skill is a set of instructions that teaches an AI coding agent how to pick the Azure role an identity needs. Give it the permissions you want an app, user or service identity to have, and it looks for the built-in Azure role that fits with the least access. This guide shows you how to install the skill, how to phrase requests so it triggers, and what to check before you run anything against a live subscription.
Azure Role Selectorgithub/awesome-copilot · MIT Download the skill Quick start
- 1Download the ZIP. Download the azure-role-selector skill ZIP from this page and unzip it.
- 2Place the folder. Copy the unzipped folder into ~/.claude/skills/ for personal use or into .claude/skills/ inside a project.
- 3Or upload in Claude apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the ZIP.
- 4Confirm Azure MCP tools. Make sure your agent has the Azure MCP server tools the skill requires.
- 5Ask a role question. Describe the identity, resource and permission you need in plain language.
- 6Review the output. Check the suggested role, the CLI commands and the Bicep snippet before running anything.
What is an agent skill and what does this one do?
An agent skill is a folder containing a SKILL.md file. The file tells a compatible agent, such as Claude Code or GitHub Copilot, when to use the skill and what steps to follow. The agent reads these instructions when your request matches the skill's description.
When you ask which Azure permission an app, user or service identity should get, this skill tells the agent to find the minimal built-in role that matches what you need. It only creates a custom role definition if no built-in role matches. It then generates the Azure CLI commands to assign that role and a Bicep code snippet for a role assignment in your infrastructure templates.
Install the azure-role-selector skill
Download the skill ZIP from this page and unzip it. The folder contains LICENSE.txt and SKILL.md. Put the unzipped folder in one of these locations:
- Personal skills for Claude Code: ~/.claude/skills/
- Project skills for one repository: the .claude/skills/ folder inside your project
- Claude apps: upload the ZIP under Settings → Capabilities → Skills
Meet the requirements
The skill depends on tools from the Azure MCP server. It needs access to Azure MCP/documentation, Azure MCP/bicepschema, Azure MCP/extension_cli_generate and Azure MCP/get_bestpractices. You also need a SKILL.md-compatible agent runtime such as Claude Code or GitHub Copilot.
To run the generated commands, you need an Azure account and a CLI context. The skill itself does not run scripts, but it does use the network to reach the Azure tools it depends on.
How do you trigger the skill with a natural request?
Describe the identity, the resource and the permission you need in plain language. The skill is meant for requests about which role to assign, so ask that question directly. The description it matches on is: when the user is asking for guidance on which role to assign to an identity given desired permissions.
- Which Azure role should my app's managed identity have to read blobs from one storage account?
- What is the least-privilege role for a service principal that needs to restart a web app?
- Give me the role assignment and Bicep snippet so my function app can write to a Key Vault.
What output should you expect?
The agent looks up the matching built-in role, explains why it fits the requirement, and gives you the Azure CLI commands to assign it to the identity. It also provides a Bicep snippet you can add to an infrastructure template. If no built-in role fits, the agent creates a custom role definition with only the permissions you asked for.
Check the suggested role and commands before running them. The skill is designed to recommend roles for a described need, not to review your existing environment.
Safety notes and tips
Review every role and command before you apply it to a live subscription, especially in production. The skill does not run scripts, but the commands it generates change access in your Azure environment when you execute them.
Describe the exact permission you need rather than a broad goal. More specific requests tend to produce a narrower role.
The skill targets Azure only. For AWS or Google Cloud, use tooling built for those clouds.
What people use it for
- Giving a managed identity read access to a single storage account without granting broader rights.
- Choosing a least-privilege role for a service principal used by a CI pipeline.
- Generating a Bicep role assignment snippet to add to an infrastructure template.
- Creating a custom role definition when no built-in role matches the permissions needed.
Frequently asked questions
Is the azure-role-selector skill free to use?
The skill is released under the MIT licence, which allows use, copying and modification with the licence text included. You still need your own Azure account and agent runtime to use it.
What do I need to run the azure-role-selector skill?
You need the Azure MCP server providing the documentation, bicepschema, extension_cli_generate and get_bestpractices tools, plus a SKILL.md-compatible agent such as Claude Code or GitHub Copilot. An Azure account and CLI context are needed if you want to run the generated commands.
Where do I install the azure-role-selector skill in Claude Code?
Unzip the downloaded folder into ~/.claude/skills/ for personal use, or into the .claude/skills/ folder of a project for team use. In the Claude apps, upload the ZIP under Settings → Capabilities → Skills.
Does this skill work with AWS or Google Cloud?
No. The skill only targets Azure tooling and documentation, so it cannot recommend AWS IAM or Google Cloud roles.
Does the skill run scripts on my machine?
No, the skill does not run scripts. It does use the network to reach the Azure MCP tools it depends on.
Will the skill audit my existing Azure permissions?
No. It only recommends roles for a need you describe. For general security auditing of an existing environment, use a tool designed for that purpose.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you regularly set up access for managed identities, service principals or apps in Azure and want least-privilege suggestions with CLI and Bicep output. Pick something else if you work outside Azure, need an audit of existing permissions, or want changes applied automatically without your own review.
Download the skill