Create custom roles in Azure

View the various actions available that you want to grant, this can be done with PowerShell such as:
Get-AzureRmProviderOperation -OperationSearchString "Microsoft.Compute/*"
Get-AzureRmProviderOperation -OperationSearchString "Microsoft.Compute/virtualMachines/*/action" | ft Operation, OperationName
Get-AzureRmProviderOperation -OperationSearchString "Microsoft.Network/*"
Get-AzureRmProviderOperation -OperationSearchString "Microsoft.Storage/*"

Export out an existing role that is similar to the custom role you wish to create to a JSON file
Get-AzureRmRoleDefinition -Name "Virtual Machine Contributor" | ConvertTo-Json | Out-File c:tempvmoperator.json

Open up the JSON file in Notepad

Delete the two lines that are the ID and IsCustom

Modify the name of the role and the description

Change the permissions for the resoruces to those actually required. For example in my example of creating a VM operator that just starts and stops I replaced the content of permissions with:
"Microsoft.Compute/*/read",
"Microsoft.Network/*/read",
"Microsoft.Storage/*/read",
"Microsoft.Compute/virtualMachines/start/action",
"Microsoft.Compute/virtualMachines/restart/action",
"Microsoft.Resources/subscriptions/resourceGroups/read",
"Microsoft.Storage/storageAccounts/listKeys/action",
"Microsoft.Support/*",
"Microsoft.Authorization/*/read",
"Microsoft.Insights/alertRules/*"

For the AssignableScopes you must set the subscription that the role will apply to since you don't have permission to change the Azure global set of roles. change the "/" line to "/subscriptions/"

Save the file

Import the role using:
New-AzureRmRoleDefinition -InputFile C:tempvmoperator.json