Azure RBAC Role Selector

Find the right Azure role by mapping required actions to least-privilege built-in roles.

When to Use

• Assigning RBAC to a Managed Identity for a new service
• Reviewing existing role assignments for over-privilege
• Choosing between built-in roles for Cognitive Services, Storage, etc.
• Creating custom roles when no built-in role fits

Common AI Workload Role Map

CLI: Find Matching Roles

# List roles that include a specific action
az role definition list \
  --query "[?contains(permissions[0].actions, 'Microsoft.CognitiveServices/accounts/deployments/read')].{Name:roleName, Id:name}" \
  -o table

# Check what permissions a role grants
az role definition list --name "Cognitive Services OpenAI User" \
  --query "[0].permissions[0].{Actions:actions, DataActions:dataActions}" -o json

Assign with Bicep

var roles = {
  cognitiveServicesOpenAIUser: '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd'
  storageBlobDataReader: '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1'
  keyVaultSecretsUser: '4633458b-17de-408a-b874-0445c86b69e6'
}

resource openAIRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(openAI.id, appIdentity.id, roles.cognitiveServicesOpenAIUser)
  scope: openAI
  properties: {
    principalId: appIdentity.properties.principalId
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roles.cognitiveServicesOpenAIUser)
    principalType: 'ServicePrincipal'
  }
}

Audit Existing Assignments

# Find over-privileged assignments (Contributor/Owner on broad scope)
az role assignment list --scope /subscriptions/$SUB \
  --query "[?roleDefinitionName=='Contributor' || roleDefinitionName=='Owner'].{Principal:principalName, Role:roleDefinitionName, Scope:scope}" \
  -o table

Troubleshooting

Best Practices

Quality Checklist

• [ ] Requirements clearly defined
• [ ] Implementation follows project conventions
• [ ] Tests cover happy path and error paths
• [ ] Documentation updated
• [ ] Peer reviewed
• [ ] Validated in staging environment

Related Skills

• fai-implementation-plan-generator — Planning and milestones
• fai-review-and-refactor — Code review patterns
• fai-quality-playbook — Engineering quality standards