What is the min IAM role required to create Azure Policy and Blueprint

Question

What is the min IAM role required to create Azure Policy and Blueprint

Pallab Chakraborty 401

I have contributor access to a subscription. But i am not able to create Azure Policy and assign it to a particular resource group under the subscription. What is the role i needed to be assigned to if i need to create an Azure Policy and apply it to a subscription or a management group level.

Thanks

1 answer

Your answer

Answer 1

@Anonymous Below are the roles which are available by default for Azure Policy and Blueprint:

Resource Policy Contributor: Can perform most Azure Policy operations.
Blueprint Contributor: Can manage blueprint definitions, but not assign them.
Blueprint Operator: Can assign existing published blueprints, but can't create new blueprint definitions. Blueprint assignment only works if the assignment is done with a user-assigned managed identity.

However, if you think that these roles have more permissions than what you need, you can create a custom role as explained here: https://dori-uw-1.kuma-moon.com/en-us/azure/role-based-access-control/custom-roles

The permissions that you would need to add under "Actions" section of the custom role are provided in below links:

You can add desired permissions that you want to assign to the users via custom role. You can also create a single role for both Azure Policy as well as for Blueprint.

-----------------------------------------------------------------------------------------------------------

Please "Accept as answer" wherever the information provided helps you to help others in the community.

Share via

What is the min IAM role required to create Azure Policy and Blueprint

1 answer

Your answer