Assigning create resource group permission only to the Azure user

Question

I am the owner of the Azure subscription. I have already given the following permissions to the user: Virtual Machine Contributor, Virtual Machine user login, Storage contributor and Network Contributor.

Now, how do I give access to creating resource group permission to the user? without giving the contributor/owner level access to the subscription level. So that the user can create a new resource group in the particular subscription

Answer 1

@Navin Prasad Kumar , There are no explicit roles available to achieve the same. Usually, an owner or contributor role is what is needed on the subscription to get the user the power to create the resource groups within a Subscription.

You would need to create a custom RBAC role for this and then try. You can take a look at the sample below and give it a try:

New-AzRoleDefinition -InputFile newrole.json  
  
    {  
        "Name":  "XXX ReadOnly",  
        "Id":  "bbcd72a7-2285-48ef-bn72-f606fba81fe7",  
        "IsCustom":  false,  
        "Description":  "Lets you view everything, Create Resource Groups but not make any changes.",  
        "Actions":  [  
                        "*/read",  
                        "Microsoft.Resources/subscriptions/resourceGroups/write"  
                    ],  
        "NotActions":  [  
                       ],  
        "DataActions":  [  
                        ],  
        "NotDataActions":  [  
                           ],  
        "AssignableScopes":  [                             
                                 "/subscriptions/id"  
                             ]  
    }  

Hope this helps.

Do let us know if this helps and if there are any more queries around this, please do let us know so that we can help you further. Also, please do not forget to accept the response as Answer; if the above response helped in answering your query.