Skip to content
Get packs

Azure Role Selector

Picks the least-privilege Azure role for an identity and shows how to assign it

Source Download skill
Repository
github/awesome-copilot
Stars
40,703
Licence
MIT
Files
2 files

What it does

When you ask which Azure permission an app, user or service identity should get, this skill tells the agent to look up the built-in Azure role that matches what you need with the least access, and to create a custom role only if no built-in one fits. It then gives you the Azure CLI commands to assign that role and a Bicep code snippet you can add to infrastructure templates.

Great for

  • Developers setting up access for a managed identity, service principal or app in Azure
  • Cloud or platform engineers who want least-privilege role assignments without reading every built-in role list
  • Teams writing Bicep infrastructure-as-code who need a role assignment snippet

Skip it if

  • Non-Azure clouds such as AWS or Google Cloud, because the skill only targets Azure tooling and documentation
  • Production changes applied without review, since the agent's suggested role and commands should be checked before running against a live subscription
  • Users who need general security auditing of an existing environment, since the skill only recommends roles for a described need

Try asking

  • “Which Azure role should my web app's managed identity have to read blobs from one storage account?”
  • “Give me the Azure CLI commands to assign the right role to this service principal on a Key Vault.”
  • “Write a Bicep snippet that grants a function app identity the minimum role to publish to a Service Bus topic.”
  • “No built-in role fits my permissions, so help me create a custom role definition.”
Step-by-step guide: how to use Azure Role SelectorInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 2 original files, the MIT licence and an attribution note.

    azure-role-selector.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip azure-role-selector.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip azure-role-selector.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Describe the exact actions needed (for example read blobs in one container) and the resource scope, so the least-privilege match is precise.
  • Review the generated CLI commands and role definition before running them, especially custom roles.
  • Confirm the Azure MCP tools are connected, since the skill depends on them to look up current role definitions and Bicep schemas.

What's inside

  • LICENSE.txt
  • SKILL.md

Redistributed unmodified from github/awesome-copilot under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.