Skip to main content

Azure Custom Roles: Least-Privilege Write Access

Overview​

Spotto generates a JSON template for an Azure custom role that holds only the actions for the write permissions you select in the Spotto Portal. Use it instead of a broad built-in role.

How to Use the Custom Role Templates​

  1. In the Cloud Accounts form, select the write permissions you want to enable
  2. Expand the "Custom Role for Least Privilege" section
  3. The section contains a JSON template tailored to your selected permissions
  4. Click the copy button to copy the JSON template
  5. Follow the instructions below to create the custom role in Azure

Creating a Custom Role in Azure​

You can create a custom role using the JSON template in several ways:

Option 1: Azure Portal​

  1. Go to Subscriptions in the Azure Portal
  2. Select your subscription
  3. Navigate to Access Control (IAM)
  4. Click Add > Add custom role
  5. Click Start from JSON
  6. Paste the JSON template from Spotto
  7. Review and create the role
  8. Assign the new custom role to your Spotto write access service principal

Option 2: Azure CLI​

# Save the JSON template to a file (e.g., spotto-custom-role.json)
az role definition create --role-definition spotto-custom-role.json

Option 3: PowerShell​

# Save the JSON template to a file (e.g., spotto-custom-role.json)
New-AzRoleDefinition -InputFile "spotto-custom-role.json"

Template Structure​

Each JSON template includes:

  • roleName - Spotto Access, or Spotto Policy Exemptions when policy exemptions is the only permission selected
  • description - What the role allows
  • assignableScopes - The subscription where the role can be assigned
  • permissions - The combined actions for every write permission you selected

Example Template​

The template shown in the Spotto Portal combines all the permissions you've enabled.
The example below includes Advisor plus future Storage Inventory write provisioning actions:

{
  "properties": {
    "roleName": "Spotto Access",
    "description": "Custom role for Spotto with combined permissions for all enabled features",
    "assignableScopes": [
      "/subscriptions/{subscriptionId}"
    ],
    "permissions": [
      {
        "actions": [
          "Microsoft.Advisor/recommendations/suppressions/delete",
          "Microsoft.Advisor/recommendations/suppressions/write",
          "Microsoft.Advisor/recommendations/write",
          "Microsoft.Storage/storageAccounts/inventoryPolicies/read",
          "Microsoft.Storage/storageAccounts/inventoryPolicies/write"
        ],
        "notActions": [],
        "dataActions": [],
        "notDataActions": []
      }
    ]
  }
}

Replace {subscriptionId} with your actual Azure subscription ID before creating the role.

Assigning the Custom Role​

After creating the custom role:

  1. Navigate to your Azure subscription
  2. Go to Access Control (IAM)
  3. Click Add > Add role assignment
  4. Select your custom role (e.g., "Spotto Access")
  5. Under Assign access to, choose User, group, or service principal
  6. Click Select members, find your Spotto write access app (e.g., Spotto Write)
  7. Click Review + assign

Updating Custom Roles​

If you enable additional write permissions later:

  1. Get the updated JSON template from the Spotto Portal
  2. Update the role definition in Azure:
    • Azure Portal: Edit the custom role and update the actions
    • Azure CLI: az role definition update --role-definition spotto-custom-role.json
    • PowerShell: Set-AzRoleDefinition -InputFile "spotto-custom-role.json"

Troubleshooting​

az role definition create fails​

What you're seeing: Azure CLI returns an error when creating the custom role.
Likely causes:

  • The JSON file is not valid or contains placeholder values (like {subscriptionId}).
  • Your user account lacks permission to create custom roles. How to fix:
  1. Replace placeholders (especially {subscriptionId}) with real values before running the command.
  2. Validate the JSON structure (a quick check is to open it in an editor with JSON validation).
  3. Confirm you have Owner or User Access Administrator on the subscription (or ask an admin to create the role).

For validation and permission errors after assigning the role, see Troubleshooting.

Learn More​

Next Steps​

For further assistance, please Contact Us.