Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.
Create custom roles in Azure
Create a custom role in Azure AD.
John Savill
April 22, 2016
1 Min Read
Q. How can I create a custom role in Azure?
A. There are a large number of roles available in Azure that can be assigned to users and groups. Some of them are generic applying to any type of resource while others are resource type specific, for example focused on Virtual Machines. It is possible to create your own custom roles through PowerShell and easiest way to do this is to export out an existing built-in role to a JSON file, modify the JSON file then import back in with a new name. The steps below walk through the basic steps:
View the various actions available that you want to grant, this can be done with PowerShell such as:
Get-AzureRmProviderOperation -OperationSearchString "Microsoft.Compute/*"
Get-AzureRmProviderOperation -OperationSearchString "Microsoft.Compute/virtualMachines/*/action" | ft Operation, OperationName
Get-AzureRmProviderOperation -OperationSearchString "Microsoft.Network/*"
Get-AzureRmProviderOperation -OperationSearchString "Microsoft.Storage/*"Export out an existing role that is similar to the custom role you wish to create to a JSON file
Get-AzureRmRoleDefinition -Name "Virtual Machine Contributor" | ConvertTo-Json | Out-File c:tempvmoperator.jsonOpen up the JSON file in Notepad
Delete the two lines that are the ID and IsCustom
Modify the name of the role and the description
Change the permissions for the resoruces to those actually required. For example in my example of creating a VM operator that just starts and stops I replaced the content of permissions with:
"Microsoft.Compute/*/read",
"Microsoft.Network/*/read",
"Microsoft.Storage/*/read",
"Microsoft.Compute/virtualMachines/start/action",
"Microsoft.Compute/virtualMachines/restart/action",
"Microsoft.Resources/subscriptions/resourceGroups/read",
"Microsoft.Storage/storageAccounts/listKeys/action",
"Microsoft.Support/*",
"Microsoft.Authorization/*/read",
"Microsoft.Insights/alertRules/*"For the AssignableScopes you must set the subscription that the role will apply to since you don't have permission to change the Azure global set of roles. change the "/" line to "/subscriptions/"
Save the file
Import the role using:
New-AzureRmRoleDefinition -InputFile C:tempvmoperator.json
The role will show in the portal and can be assigned to users.
About the Author
You May Also Like
