Azure role-based access control (RBAC) decides who can do what, and where. This guide follows Microsoft Learn’s portal steps for creating a role assignment.
Before you start
- Permission: you need
Microsoft.Authorization/roleAssignments/write, typically through Role Based Access Control Administrator or User Access Administrator. Without it, Add role assignment is disabled. - Licensing (optional): eligible (just-in-time) and time-bound assignments require Microsoft Entra ID P2 or Microsoft Entra ID Governance. The Assignment type tab appears only with those licences.
- Microsoft Entra administrator roles are a different thing and use a separate article.
Step 1: Pick the scope
Sign in to the Azure portal and open the management group, subscription, resource group or resource you want to grant access to. Scope levels run from broad to narrow in that order. Assign at the narrowest scope that works.
Step 2: Open Access control (IAM)
Open Access control (IAM), select the Role assignments tab, then Add > Add role assignment.
Step 3: Choose the role
On the Role tab choose Job function roles or Privileged administrator roles, select a role (use View to see its permissions), and click Next.
Step 4: Add members
- On Members, choose User, group, or service principal or Managed identity.
- Click Select members, pick the principals and click Select.
- Add an optional Description and click Next.
Step 5: Conditions (only for some roles)
- For Owner, RBAC Administrator and User Access Administrator you can limit which roles the user may assign, and to which principals.
- For selected storage data roles, Add condition adds attribute-based restrictions.
- For other roles this step is skipped.
Step 6: Assignment type (P2 or Governance only)
Choose Eligible or Active, then Permanent or Time bound. If you don’t use Privileged Identity Management, select Active and Permanent.
Step 7: Review and assign
Review the settings and click Review + assign. The role then appears in the Role assignments list at that scope; use Edit columns to show the Description.
Edit an assignment
On Access control (IAM) > Role assignments, click the assignment’s State link (for example “Eligible time-bound”), change it in the Edit assignment pane and Save. Editing requires the P2 or Governance licence, and updates might take a while to appear in the portal.
What Microsoft’s page doesn’t cover
- Removing assignments. It links to a separate article.
- A specific propagation delay. It says only that “after a few moments” a new assignment takes effect.
- Other verification methods beyond checking the Role assignments list.
Quick checklist
- Narrowest sensible scope
- Least-privileged role that does the job
- Groups preferred over individual users where practical
- Assignment appears in the Role assignments list
