Skip to main content

Azure Custom Roles: Least-Privilege Write Access

Overview​

Spotto provides JSON templates for creating custom Azure roles with minimal permissions for each write permission. These templates automatically reflect the specific permissions you've selected in the Spotto Portal.

Why Use Custom Roles​

Custom roles provide:

  • Minimal permissions - Only grant the exact actions needed
  • Enhanced security - Reduce the attack surface
  • Better compliance - Meet strict security requirements
  • Granular control - Customize permissions for your organization

Custom roles allow you to grant only the exact permissions needed, rather than using broad built-in roles.

How to Use the Custom Role Templates​

  1. In the Cloud Accounts form, select the write permissions you want to enable
  2. Expand the "Custom Role for Least Privilege" section
  3. The section contains a JSON template tailored to your selected permissions
  4. Click the copy button to copy the JSON template
  5. Follow the instructions below to create the custom role in Azure

Creating a Custom Role in Azure​

You can create a custom role using the JSON template in several ways:

Option 1: Azure Portal​

  1. Go to Subscriptions in the Azure Portal
  2. Select your subscription
  3. Navigate to Access Control (IAM)
  4. Click Add > Add custom role
  5. Click Start from JSON
  6. Paste the JSON template from Spotto
  7. Review and create the role
  8. Assign the new custom role to your Spotto write access service principal

Option 2: Azure CLI​

# Save the JSON template to a file (e.g., spotto-custom-role.json)
az role definition create --role-definition spotto-custom-role.json

Option 3: PowerShell​

# Save the JSON template to a file (e.g., spotto-custom-role.json)
New-AzRoleDefinition -InputFile "spotto-custom-role.json"

Template Structure​

Each JSON template includes:

  • roleName - The name for the custom role (e.g., "Spotto Access")
  • description - Description of what the role allows
  • assignableScopes - Subscription-level scope where the role can be assigned
  • permissions - The minimal required actions based on your selections

The template automatically combines permissions from all the write permissions you've enabled, ensuring you only grant the minimum access required.

Example Template​

The template shown in the Spotto Portal combines all the permissions you've enabled.
The example below includes Advisor plus future Storage Inventory write provisioning actions:

{
  "properties": {
    "roleName": "Spotto Access",
    "description": "Custom role for Spotto with combined permissions for all enabled features",
    "assignableScopes": [
      "/subscriptions/{subscriptionId}"
    ],
    "permissions": [
      {
        "actions": [
          "Microsoft.Advisor/recommendations/suppressions/delete",
          "Microsoft.Advisor/recommendations/suppressions/write",
          "Microsoft.Advisor/recommendations/write",
          "Microsoft.Storage/storageAccounts/inventoryPolicies/read",
          "Microsoft.Storage/storageAccounts/inventoryPolicies/write"
        ],
        "notActions": [],
        "dataActions": [],
        "notDataActions": []
      }
    ]
  }
}

Replace {subscriptionId} with your actual Azure subscription ID before creating the role.

Assigning the Custom Role​

After creating the custom role:

  1. Navigate to your Azure subscription
  2. Go to Access Control (IAM)
  3. Click Add > Add role assignment
  4. Select your custom role (e.g., "Spotto Access")
  5. Under Assign access to, choose User, group, or service principal
  6. Click Select members, find your Spotto write access app (e.g., Spotto AI Write)
  7. Click Review + assign

Updating Custom Roles​

If you enable additional write permissions later:

  1. Get the updated JSON template from the Spotto Portal
  2. Update the role definition in Azure:
    • Azure Portal: Edit the custom role and update the actions
    • Azure CLI: az role definition update --role-definition spotto-custom-role.json
    • PowerShell: Set-AzRoleDefinition -InputFile "spotto-custom-role.json"

Troubleshooting​

az role definition create fails​

What you're seeing: Azure CLI returns an error when creating the custom role.
Likely causes:

  • The JSON file is not valid or contains placeholder values (like {subscriptionId}).
  • Your user account lacks permission to create custom roles. How to fix:
  1. Replace placeholders (especially {subscriptionId}) with real values before running the command.
  2. Validate the JSON structure (a quick check is to open it in an editor with JSON validation).
  3. Confirm you have Owner or User Access Administrator on the subscription (or ask an admin to create the role).

Changes don’t take effect immediately​

What you're seeing: Spotto validation still fails right after you assign the role.
Likely causes: Azure role assignment propagation delay.
How to fix:

  1. Wait 5–10 minutes after role assignment changes.
  2. Re-run validation in Spotto.

Learn More​

Next Steps​

For further assistance, please Contact Us.