Search code examples
azurerolesrbac

Create custom role for subscription in azure


We have set up an Azure AD which holds a few subscriptions. For the subscriptions handling live projects I want developers to have limited access.

Today I have solved this with the built in roles that are listed here: https://azure.microsoft.com/en-us/documentation/articles/role-based-access-built-in-roles/

But for instance if I enable "Website Contributor" for developers they can delete projects, something I am not keen on. But I would like them to be able to restart the server for instance and maybe a few other things.

Can I somehow create my own custom role that shows up on the subscription role list that I can then assign account users and account groups to?


Solution

  • Yes, you can create custom roles in your Azure Subsciption and assign users in those roles using Azure Portal or PowerShell. This functionality was recently announced by Azure team.

    Please look at this blog post from Dushyant Gill from RBAC team for more details: https://blogs.technet.microsoft.com/ad/2015/12/10/custom-roles-in-azure-rbac-is-now-ga/