Azure Role Selector skill for Claude: pick the least-privilege Azure role

Makes Claude find the smallest Azure role that fits what an identity must do, then write the command and Bicep to assign it.

Installs: 9.4K; on skills.sh
Stars: 40.7K; on GitHub
Files: 1; besides SKILL.md
Updated: Oct 2026; last repo commit

Describe what an identity needs to do in Azure, and the skill tells Claude to look up the minimal role that covers it with the Azure MCP documentation tool. If no built-in role matches, it asks for a custom role definition instead.

It then asks for the CLI commands that assign the role and a Bicep snippet for the role assignment. It only works with the Azure MCP tools connected: SKILL.md lists four of them in allowed-tools. The folder bundles no scripts.

Good for

Azure admins who assign roles and want least privilege
Developers who write Bicep for role assignments
Teams that need a custom role when no built-in role fits

Install azure-role-selector

Claude Code

Copy this prompt.

Install the azure-role-selector skill in Claude Code. Run this command:

/plugin install azure@claude-plugins-official

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

The skill calls Azure MCP tools, so install the Azure MCP server as well as the skill. The Azure plugin route comes from the Azure MCP server README; it packages the Azure MCP server with Azure-related agents and skills. See the Azure MCP Server page for other clients. The skills CLI and folder routes install only this skill.

From the project README. Source.

What's in the skill

When it loads

When user is asking for guidance for which role to assign to an identity given desired permissions, this agent helps them understand the role that will meet the requirements with least privilege access and how to apply that role.

Key facts

Author: Listed in github/awesome-copilot (community-contributed); the LICENSE.txt in the skill folder names Microsoft Corporation as copyright holder
License: MIT
Installs on skills.sh: 9,400 (Nov 2, 2026)
GitHub stars: 40,666 for the whole github/awesome-copilot repo (Nov 2, 2026)
Last repo commit: Oct 30, 2026
Audits on skills.sh: Gen Agent Trust Hub: pass, Socket: pass, Snyk: pass
What it includes: 2 files: SKILL.md and LICENSE.txt (bundles no scripts)
Needs: The Azure MCP server, which provides the four tools listed in SKILL.md

What it includes

Finds the smallest role that matches the permissions you want
Claude uses this tool to look up which built-in Azure role covers the permissions you describe, aiming for least privilege.
Try: “Which Azure role lets this managed identity read blobs in one storage account and nothing else?”
Read · Azure MCP/documentation
Builds a custom role or the assignment commands
If no built-in role fits, Claude uses this tool to create a custom role definition. It also uses it to generate the CLI commands that assign the role to the identity.
Read · Azure MCP/extension_cli_generate
Supplies the Bicep shape for a role assignment
Used together with get_bestpractices to give you a Bicep snippet for adding the role assignment.
Read · Azure MCP/bicepschema
Adds Azure best practices to the Bicep snippet
Used together with bicepschema when Claude writes the Bicep code for the role assignment.
Read · Azure MCP/get_bestpractices

From the official docs

Permissions

Low risk

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

The commands it writes change Azure access
SKILL.md asks for CLI commands and Bicep that assign a role. Read the role and the scope in each one before you run it. Our advice: a role at a wide scope reaches everything below it. github.com
It depends on the Azure MCP server
The skill does nothing without those tools. Sign-in and permissions come from how you set up that server; see the Azure MCP Server page. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details

Turning on read-only	No read-only mode. The skill asks for commands and code; it names no switch that blocks them.
Sign-in and keys	SKILL.md names no key or token. The Azure MCP tools it calls are set up separately.
Scopes	Calls four Azure MCP tools: documentation, bicepschema, extension_cli_generate and get_bestpractices Asks for CLI commands and Bicep that assign an Azure role

Questions

What does azure-role-selector do?

It tells Claude to find the least-privilege Azure role for an identity, using the Azure MCP documentation tool. It then asks for the CLI commands to assign the role and a Bicep snippet. If no built-in role fits, it asks for a custom role definition.

How do I install azure-role-selector?

Use the install box at the top of this page. The skill only works when the Azure MCP tools are available, so set up the Azure MCP Server too.

Does it need an API key?

SKILL.md names no key or token. The Azure MCP server it calls has its own setup; see its page for sign-in details.

Is azure-role-selector safe?

The folder holds SKILL.md and a license file, with no scripts. It asks Claude for commands and Bicep that grant Azure access, so read each command before you run it and check the scope it targets.

How is it different from the Azure MCP server?

The Azure MCP Server provides the tools. This skill is a short instruction that tells Claude to use four of them to choose and assign a role.

Information

updated Nov 2, 2026

Repository: github/awesome-copilot
Folder: skills/azure-role-selector

github/awesome-copilot skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 3

azure-role-selector SKILL.md · github.com
azure-role-selector folder · github.com
Azure MCP Server README · github.com