How to Assign Role in Azure: Step-by-Step Guide

To assign a role in Azure, use the az role assignment create command with parameters for --assignee, --role, and --scope. This command grants the specified user or service principal the chosen role at the defined scope.

Syntax

The basic syntax to assign a role in Azure using Azure CLI is:

• az role assignment create: Command to create a role assignment.
• --assignee: The user, group, or service principal to assign the role to.
• --role: The name or ID of the role to assign (e.g., Contributor, Reader).
• --scope: The resource or resource group where the role applies.

bash

az role assignment create --assignee <assignee> --role <role> --scope <scope>

Example

This example assigns the Contributor role to a user with email [e-mail] at a specific resource group scope.

bash

az role assignment create --assignee [e-mail] --role Contributor --scope /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup

Output

{
  "canDelegate": false,
  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleAssignments/12345678-1234-1234-1234-123456789abc",
  "name": "12345678-1234-1234-1234-123456789abc",
  "principalId": "abcdef12-3456-7890-abcd-ef1234567890",
  "principalType": "User",
  "roleDefinitionId": "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
  "scope": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup",
  "type": "Microsoft.Authorization/roleAssignments"
}

Common Pitfalls

• Using an incorrect --assignee value such as a display name instead of an email or object ID.
• Omitting the --scope parameter, which defaults to the subscription and may assign roles too broadly.
• Trying to assign a role without sufficient permissions yourself.
• Confusing role names; always verify the exact role name or ID.

bash

az role assignment create --assignee "John Doe" --role Contributor

# Correct way:
az role assignment create --assignee [e-mail] --role Contributor --scope /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup

Quick Reference

Parameter	Description	Example
--assignee	User, group, or service principal to assign role	[e-mail]
--role	Role name or ID to assign	Contributor
--scope	Resource or resource group scope for the role	/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup

Key Takeaways

Use az role assignment create with --assignee, --role, and --scope to assign roles.

Always specify the correct scope to limit role permissions to the intended resources.

Verify the assignee identifier is an email or object ID, not just a display name.

Ensure you have permission to assign roles before running the command.

Check role names carefully to avoid assignment errors.