Azure Role Selector (RBAC Least Privilege)

Azure RBAC grants access through role assignments = security principal + role definition + scope. The goal is least privilege: the minimum role at the narrowest scope that meets the need, assigned to the right kind of principal (group for humans, managed identity for workloads), and time-bound via PIM where it is privileged.

When to use

Choosing the correct role for a user, group, service principal, or managed identity - or reviewing existing assignments for excess privilege.

Do not use this skill for:

• Entra ID directory roles (Global Admin, User Admin, etc.) (use entra-id)
• Microsoft 365 admin roles (use m365-govern-manage)
• Activating privileged roles or designing access reviews (use azure-pim)
• Multicloud entitlement management (use entra-permissions-management)

Pick the right role family