Azure Custom Roles - Help

Question

We have a specific process to onboard and manage users that I need to assign to some admins the permissions necessary to perform these specific actions and no more. I can assign the broad supplied roles but that provides more permissions than we'd like. I am lookin at this this document: Tutorial: Create an Azure custom role using Azure PowerShell tutorial-custom-role-powershell .

I need to provide the permissions to perform these specific functions:

1. Add/remove an EXISTING user from an existing Azure AD group (not create groups).
2. Set MFA Auth Status here: MultifactorVerification.aspx
   
3. In the Azure AD -> User -> Authentication Methods blade, user the "Reset password", "Require re-register MFA", and "Revoke MFA Sessions" links.
   

From the above document, I seems that I can make a custom role to perform just these tasks but I have to find very specific info on the specific tasks I mention above. So my question - how to I go about identifying these specific tasks enough to create a custom role as described? Try as I might, I can't see how to find how to set this up so any guidance would be very much appreciated!

Thanks!
Jim

Answer 1

Hello @DingoDigits-2736 , the refered documentation is about RBAC roles, what you're looking for are Azure AD roles. The rights for the specific tasks you're looking for are not available. For those you will have to choose one of the built in Azure AD roles with the lesser permission set.

Let us know if this answer was helpful to you. If so, please remember to mark it as the answer so that others in the community with similar questions can more easily find a solution.