azure-role-selector
When user is asking for guidance for which role to assign to an identity given desired permissions, this agent helps them understand the role that will meet the requirements with least privilege access and how to apply that role.
Summary
- Purpose
- It maps requested Azure permissions to the least-privilege built-in role, or a custom role if no built-in role matches.
- When to use
- Use it when you have an identity and specific Azure permissions in mind and need guidance on implementing the role assignment.
- Outputs
- It provides a matching built-in or custom role definition, Azure CLI commands to assign it, and a Bicep snippet for the role assignment.
Upstream changes (2, latest included 2026-01-05)
78e0b5a Update skills/azure-role-selector/SKILL.md Added a space between "identity" and its parenthetical note in the role-assignment guidance. 42f2972 add azure role selector skills Added the azure-role-selector skill with instructions to identify or create a least-privilege role and provide Azure CLI and Bicep role-assignment guidance using the specified Azure MCP tools. npx skills add "lettucebo/Skills#v2.2.0@azure-role-selector" --full-depth ⚠ Available after v2.2.0 is published
Use 'Azure MCP/documentation' tool to find the minimal role definition that matches the desired permissions the user wants to assign to an identity (If no built-in role matches the desired permissions, use 'Azure MCP/extension_cli_generate' tool to create a custom role definition with the desired permissions). Use 'Azure MCP/extension_cli_generate' tool to generate the CLI commands needed to assign that role to the identity and use the 'Azure MCP/bicepschema' and the 'Azure MCP/get_bestpractices' tool to provide a Bicep code snippet for adding the role assignment.