Do you have an idea or suggestion based on your experience with Azure Management Groups?

Allow custom RBAC Definitions at the Management Group Level

The customer I currently work with has several custom roles that are currently maintained in a central subscription. This has become quite burdensome as every new subscription which needs the role assigned needed to have the Role.AssignableScopes attribute appended with the custom role. We would like to centrally manage these, using management groups similar to the way we manage Policy applied over several subscriptions.

163 votes
Sign in
Sign in with: Microsoft
Signed in as (Sign out)

We’ll send you updates on this idea

Bennett Battistoni shared this idea  ·   ·  Flag idea as inappropriate…  ·  Admin →

Hi Everyone,
I apologize about the delay but Custom RBAC Support is now available in Production. You are able to to create role definitions at the MG scope and assign them to inherited MGs and Subs.

There is a bug that is in the portal where the new custom role is not showing when you are trying to do a role assignment on an inherited child MG/Sub. This should be resolved soon and PowerShell, CLI, and API are all working. I will not do any announcements yet on the availability of the feature until the portal bug is fixed. Once that is fixed we will do blog announcements and I will mark the feature complete here.


Sign in
Sign in with: Microsoft
Signed in as (Sign out)
  • Dax Fohl commented  ·   ·  Flag as inappropriate

    @chuck there was a bug in the initial preview implementation. A fix for this was rolled out on Friday and the RBAC inheritance should now be working for you.

  • Trevor commented  ·   ·  Flag as inappropriate

    @Chuck - I was having the same problem. Update the Assignable Scopes to BOTH the Management Group and your Subscription. I was then able to use a Blueprint to deploy that custom Role to a Resource Group

    In Terraform:

    assignable_scopes = [

  • chuck commented  ·   ·  Flag as inappropriate

    Used this new feature, but doesn't seem to be working. Created a role definition with read action, set assignablescopes to the management group. Assigned the role at the subscription level. That worked as expected. But the user can't access any sub-resources, like resource groups. Using another account with owner over the subscription, checked the portal IAM section for the resource groups permissions. It shows the role assignment as being inherited. Tried this same test with several different roles/actions, etc. Same results.

    Submitted an incident. Waiting on response from MS

  • Logan commented  ·   ·  Flag as inappropriate

    Found the answer, and successfully tested:

    $Role.AssignableScopes.Add("/providers/Microsoft.Management/managementGroups/<management group ID>")

  • Logan commented  ·   ·  Flag as inappropriate

    Same question as the last two do we set assignable scopes to Tenant Root group or a specific MG?

  • Anonymous commented  ·   ·  Flag as inappropriate

    Great news!
    I'd like to try it, but how can I set MG ids in "assignableScopes"?

    { assignableScopes": ["?"] }

  • Dan commented  ·   ·  Flag as inappropriate

    The fact that we can't scope to mgmt group scope (or root scope for our tenant as a temporary workaround) is a huge blocker to moving on to significantly more productive work. Within my organisation we have 30-something subscriptions (and ramping up quickly), which translates to a lot of manual overhead when working with our custom roles (modifying assignable scope each time).

    Hope this (or some kind of root-scope workaround) is coming soon!

  • JH commented  ·   ·  Flag as inappropriate

    Is this feature still on track? Currently implementing MG, and we are missing custom roles support as well.

  • Hicham KADIRI commented  ·   ·  Flag as inappropriate

    Hi Az Management Group Team,

    Any news about the Custom RBAC Definitions at the Mgmt Grp level ?
    I have several customers for which i want to implement a specific RBAC model at the mgmt group level, because they have several dozen of suscriptions and it becomes harder to manage the role assignement cross all subscriptions.

    Thank's for your reply


← Previous 1

Feedback and Knowledge Base