azure-role-selector

Name: azure-role-selector
Author: vinayaklatthe

53installs34forks

How to install azure-role-selector?

vinayaklatthe/microsoft-security-skills/azure-role-selector

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-role-selector

Installs into the current project.

Summary

Guidance for selecting the right Azure RBAC role with least privilege - mapping required actions to built-in roles, deciding when a custom role is needed, scoping assignments correctly, and choosing between control-plane and data-plane roles. Covers scope levels (management group

Files · 1

View on GitHub

SKILL.md

1	# Azure Role Selector (RBAC Least Privilege)
2
3	Azure RBAC grants access through role assignments = security principal + role definition +
4	scope. The goal is least privilege: the minimum role at the narrowest scope that meets the
5	need, assigned to the right kind of principal (group for humans, managed identity for
6	workloads), and time-bound via PIM where it is privileged.
7
8	## When to use
9	Choosing the correct role for a user, group, service principal, or managed identity - or
10	reviewing existing assignments for excess privilege.
11
12	Do not use this skill for:
13	- Entra ID directory roles (Global Admin, User Admin, etc.) (use `entra-id`)
14	- Microsoft 365 admin roles (use `m365-govern-manage`)
15	- Activating privileged roles or designing access reviews (use `azure-pim`)
16	- Multicloud entitlement management (use `entra-permissions-management`)
17
18	## Pick the right role family
19
20	\| Caller needs to... \| Look at \| Avoid \|
21	\|---\|---\|---\|
22	\| Read storage account properties \| Control-plane: Reader / Storage Account Contributor \| Owner \|
23	\| Read blob contents \| Data-plane: Storage Blob Data Reader \| Reader alone (no data access) \|
24	\| Write blob contents \| Data-plane: Storage Blob Data Contributor \| Owner / Contributor \|
25	\| Read Key Vault secrets (RBAC mode) \| Data-plane: Key Vault Secrets User \| Key Vault Administrator \|
26	\| Manage Key Vault itself \| Control-plane: Key Vault Contributor \| Owner \|
27	\| Run an Azure Function with managed identity \| Data role on target resource only \| Subscription Contributor \|
28	\| Delegate role assignment to others \| User Access Administrator at narrow scope \| Owner \|
29	\| Read everything in a subscription \| Reader at subscription \| Owner / Contributor \|
30	\| Manage one resource group only \| Contributor at the resource group \| Subscription Contributor \|
31
32	> Rule of thumb: Control-plane roles do not automatically grant data-plane access.
33	> Reader lets you see a storage account exists; it does not let you read a blob. Pick
34	> the right plane explicitly. This is the single most common RBAC mistake.
35
36	## Approach
37
38	1. Define the required actions precisely - List the exact operations the principal must
39	perform. Distinguish control plane (manage the resource: create, delete, list, configure)
40	from data plane (read or write the data inside: blobs, secrets, queue messages, rows).
41	*Verify: requirements are written as verbs and resource types, e.g. "read blob contents in
42	container X" rather than "access storage".*
43	2. Match the most specific built-in role - Prefer the most specific built-in role whose
44	`Actions` and `DataActions` cover the need. Built-in roles are maintained by Microsoft and
45	evolve as services add capability. Avoid broad roles (Owner, Contributor) unless
46	genuinely required.
47	*Verify: the chosen built-in role's `Actions`/`DataActions` cover every required operation
48	and nothing more (use `az role definition show`).*
49	3. Decide custom vs built-in - Create a custom role only when no built-in role fits.
50	Define minimal `Actions`/`DataActions` and `NotActions`, version the JSON in source
51	control, and pin assignable scopes.
52	*Verify: a custom role exists only after confirming no built-in role covers the need; the
53	JSON is in repo with a change history.*
54	4. Scope narrowly - Assign at the lowest effective scope: resource > resource group >
55	subscription > management group. A Storage Blob Data Reader at one container is safer
56	than at the storage account, which is safer than at the subscription.
57	*Verify: the assignment scope is the smallest that satisfies the requirement; subscription-
58	wide grants for a single resource are flagged.*
59	5. Prefer identities and groups - Assign to Entra groups for users (not direct user
60	assignments) and managed identities for workloads (not service principals with secrets
61	where avoidable). Group-based assignment scales; per-user assignment does not.
62	*Verify: zero direct user assignments at subscription scope; workloads use managed
63	identities, not user accounts.*
64	6. **Combine with PIM for privi

People who liked this also viewed

6 picks

Type

azure-role-selector

53installs34forks

View on GitHub

How to install azure-role-selector?

vinayaklatthe/microsoft-security-skills/azure-role-selector

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-role-selector

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Azure Role Selector (RBAC Least Privilege)
2
3	Azure RBAC grants access through role assignments = security principal + role definition +
4	scope. The goal is least privilege: the minimum role at the narrowest scope that meets the
5	need, assigned to the right kind of principal (group for humans, managed identity for
6	workloads), and time-bound via PIM where it is privileged.
7
8	## When to use
9	Choosing the correct role for a user, group, service principal, or managed identity - or
10	reviewing existing assignments for excess privilege.
11
12	Do not use this skill for:
13	- Entra ID directory roles (Global Admin, User Admin, etc.) (use `entra-id`)
14	- Microsoft 365 admin roles (use `m365-govern-manage`)
15	- Activating privileged roles or designing access reviews (use `azure-pim`)
16	- Multicloud entitlement management (use `entra-permissions-management`)
17
18	## Pick the right role family
19
20	\| Caller needs to... \| Look at \| Avoid \|
21	\|---\|---\|---\|
22	\| Read storage account properties \| Control-plane: Reader / Storage Account Contributor \| Owner \|
23	\| Read blob contents \| Data-plane: Storage Blob Data Reader \| Reader alone (no data access) \|
24	\| Write blob contents \| Data-plane: Storage Blob Data Contributor \| Owner / Contributor \|
25	\| Read Key Vault secrets (RBAC mode) \| Data-plane: Key Vault Secrets User \| Key Vault Administrator \|
26	\| Manage Key Vault itself \| Control-plane: Key Vault Contributor \| Owner \|
27	\| Run an Azure Function with managed identity \| Data role on target resource only \| Subscription Contributor \|
28	\| Delegate role assignment to others \| User Access Administrator at narrow scope \| Owner \|
29	\| Read everything in a subscription \| Reader at subscription \| Owner / Contributor \|
30	\| Manage one resource group only \| Contributor at the resource group \| Subscription Contributor \|
31
32	> Rule of thumb: Control-plane roles do not automatically grant data-plane access.
33	> Reader lets you see a storage account exists; it does not let you read a blob. Pick
34	> the right plane explicitly. This is the single most common RBAC mistake.
35
36	## Approach
37
38	1. Define the required actions precisely - List the exact operations the principal must
39	perform. Distinguish control plane (manage the resource: create, delete, list, configure)
40	from data plane (read or write the data inside: blobs, secrets, queue messages, rows).
41	*Verify: requirements are written as verbs and resource types, e.g. "read blob contents in
42	container X" rather than "access storage".*
43	2. Match the most specific built-in role - Prefer the most specific built-in role whose
44	`Actions` and `DataActions` cover the need. Built-in roles are maintained by Microsoft and
45	evolve as services add capability. Avoid broad roles (Owner, Contributor) unless
46	genuinely required.
47	*Verify: the chosen built-in role's `Actions`/`DataActions` cover every required operation
48	and nothing more (use `az role definition show`).*
49	3. Decide custom vs built-in - Create a custom role only when no built-in role fits.
50	Define minimal `Actions`/`DataActions` and `NotActions`, version the JSON in source
51	control, and pin assignable scopes.
52	*Verify: a custom role exists only after confirming no built-in role covers the need; the
53	JSON is in repo with a change history.*
54	4. Scope narrowly - Assign at the lowest effective scope: resource > resource group >
55	subscription > management group. A Storage Blob Data Reader at one container is safer
56	than at the storage account, which is safer than at the subscription.
57	*Verify: the assignment scope is the smallest that satisfies the requirement; subscription-
58	wide grants for a single resource are flagged.*
59	5. Prefer identities and groups - Assign to Entra groups for users (not direct user
60	assignments) and managed identities for workloads (not service principals with secrets
61	where avoidable). Group-based assignment scales; per-user assignment does not.
62	*Verify: zero direct user assignments at subscription scope; workloads use managed
63	identities, not user accounts.*
64	6. **Combine with PIM for privi

People who liked this also viewed

6 picks

Type