← cd ~/tools
// tools/roles
Least-privilege role finder
Search for an action, such as restart virtual machine or reset password, tick the permissions the person needs, and see which built-in roles grant all of them, smallest first. Covers 504 Azure roles and 136 Microsoft Entra roles.
Runs entirely in your browser. Nothing you paste is sent anywhere.
Loading roles…
Permissions
Roles that grant everything ticked
- Tick one or more permissions.
From Microsoft's Azure built-in roles and Entra built-in roles references (data from 2026-10-10). "Smallest" counts how many permissions a role holds, with wildcards weighted heavily. If no built-in role is a good fit, a custom role with just the ticked permissions is the least-privilege answer.