What is the min IAM role required to create Azure Policy and Blueprint

Question

I have contributor access to a subscription. But i am not able to create Azure Policy and assign it to a particular resource group under the subscription. What is the role i needed to be assigned to if i need to create an Azure Policy and apply it to a subscription or a management group level.

Thanks

Answer 1

@Anonymous Below are the roles which are available by default for Azure Policy and Blueprint:

1. Resource Policy Contributor: Can perform most Azure Policy operations.
2. Blueprint Contributor: Can manage blueprint definitions, but not assign them.
3. Blueprint Operator: Can assign existing published blueprints, but can't create new blueprint definitions. Blueprint assignment only works if the assignment is done with a user-assigned managed identity.

However, if you think that these roles have more permissions than what you need, you can create a custom role as explained here: https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles

The permissions that you would need to add under "Actions" section of the custom role are provided in below links:

• https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftpolicyinsights
• https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftblueprint

You can add desired permissions that you want to assign to the users via custom role. You can also create a single role for both Azure Policy as well as for Blueprint.

-----------------------------------------------------------------------------------------------------------

Please "Accept as answer" wherever the information provided helps you to help others in the community.