Azure IAM custom roles not visible in add role assignment

Sankararao Gulipalli 0

I have created one Azure custom roles and I can see these role is available in roles section in IAM but when I try to assign this to service principal, I could not see this custom role. azure_roles

User's image

Navya 13,050 Reputation points Microsoft Vendor

2024-11-19T00:03:24.7566667+00:00

Hi @Sankararao Gulipalli

Following up to see if the below answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

1 answer

TP 99,291 Reputation points

2024-11-16T12:49:38.7733333+00:00

Hi,

Are you attempting to assign your Custom Role at one of the scopes you allowed in assignable scopes? For example, if when you created the custom role you only listed the subscription under assignable scopes tab, then the role will not show in the list if you attempt to assign it to a resource group.

If you would like to add assignable scopes you may navigate to your subscription -- Access control (IAM) blade, Roles tab, then click the context menu (three dots) on the right of your custom role and choose Edit.

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP
Please sign in to rate this answer.
Sankararao Gulipalli 0 Reputation points

2024-11-19T16:54:02.2766667+00:00

TP - Thanks for your reply, answer to your question "Are you attempting to assign your Custom Role at one of the scopes you allowed in assignable scopes?" YES, I have assigned the assignable scopes to the resource level, not the subscription or resource group level. now i want to add custom role assignment in same resource level.

"assignableScopes": [ <subscriptions>/providers/Microsoft.Storage/storageAccounts/<storagename> ]

Navya 13,050 Reputation points Microsoft Vendor

2024-11-20T00:26:48.8433333+00:00

Hi @Sankararao Gulipalli

Custom roles may only be visible for assignment within specific scopes. If you create a custom role at the resource level scope, it will only be available for assignment at the resource level.

For more information: https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles#who-can-create-delete-update-or-view-a-custom-role

Thanks,

Navya.

TP 99,291 Reputation points

2024-11-21T15:07:04.9633333+00:00

@Sankararao Gulipalli I did some testing and it seems the Azure portal Add role assignment GUI does not show Custom roles that are resource scoped. I viewed the traffic and the list of custom roles (including resource-scoped) is downloaded to the browser, however, they are not displayed.

I tested with Subscription and Resource Group scoped custom roles and they are displayed in Add role assignment GUI.

If you need to use resource-scoped custom roles then you will need to use CLI/powershell/REST api to assign them. I tested using az role assignment create CLI command and was able to successfully assign resource-scoped custom role to storage account resource.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure IAM custom roles not visible in add role assignment

1 answer

Your answer