Create custom roles in Azure

Create custom roles in Azure

Q. How can I create a custom role in Azure?

A.  There are a large number of roles available in Azure that can be assigned to users and groups. Some of them are generic applying to any type of resource while others are resource type specific, for example focused on Virtual Machines. It is possible to create your own custom roles through PowerShell and easiest way to do this is to export out an existing built-in role to a JSON file, modify the JSON file then import back in with a new name. The steps below walk through the basic steps:

  1. View the various actions available that you want to grant, this can be done with PowerShell such as:
    Get-AzureRmProviderOperation -OperationSearchString "Microsoft.Compute/*"
    Get-AzureRmProviderOperation -OperationSearchString "Microsoft.Compute/virtualMachines/*/action" | ft Operation, OperationName
    Get-AzureRmProviderOperation -OperationSearchString "Microsoft.Network/*"
    Get-AzureRmProviderOperation -OperationSearchString "Microsoft.Storage/*"
  2. Export out an existing role that is similar to the custom role you wish to create to a JSON file
    Get-AzureRmRoleDefinition -Name "Virtual Machine Contributor" | ConvertTo-Json | Out-File c:\temp\vmoperator.json
  3. Open up the JSON file in Notepad
  4. Delete the two lines that are the ID and IsCustom
  5. Modify the name of the role and the description
  6. Change the permissions for the resoruces to those actually required. For example in my example of creating a VM operator that just starts and stops I replaced the content of permissions with:
    "Microsoft.Compute/*/read",
    "Microsoft.Network/*/read",
    "Microsoft.Storage/*/read",
    "Microsoft.Compute/virtualMachines/start/action",
    "Microsoft.Compute/virtualMachines/restart/action",
    "Microsoft.Resources/subscriptions/resourceGroups/read",
    "Microsoft.Storage/storageAccounts/listKeys/action",
    "Microsoft.Support/*",
    "Microsoft.Authorization/*/read",
    "Microsoft.Insights/alertRules/*"
  7. For the AssignableScopes you must set the subscription that the role will apply to since you don't have permission to change the Azure global set of roles. change the "/" line to "/subscriptions/"
  8. Save the file
  9. Import the role using:
    New-AzureRmRoleDefinition -InputFile C:\temp\vmoperator.json

The role will show in the portal and can be assigned to users.

Hide comments

Comments

  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
Publish