Sometimes you want to be able to create custom roles that give fine grained control over your cloud platform and environments. This can be done entirely with the Azure command line interface and it is awesome!

The example role are going to create is a role that allows a user to start and stop a virtual machine.

1. Start by creating creating a json file on your local system called new_role.json with the following content:

    {
      "Name": "Virtual Machine Operator",
      "IsCustom": true,
      "Description": "Can deallocate, start  and restart virtual machines.",
      "Actions": [
        "Microsoft.Compute/*/read",
        "Microsoft.Compute/virtualMachines/start/action",
        "Microsoft.Compute/virtualMachines/restart/action",
        "Microsoft.Compute/virtualMachines/deallocate/action"
      ],
      "NotActions": [
      ],
      "AssignableScopes": [
        "/subscriptions/11111111-1111-1111-1111-111111111111"
      ]
    }

2. Log into Azure through the CLI:

az login

3. Create a role definition:

az role definition create --role-definition new_role.json

4. Create a role assignment for the new role for a user:

az role assignment create --assignee user@tenant.onmicrosoft.com --role "Virtual Machine Operator" --scope /subscriptions/c72acede-d539-45d9-963d-3464ec4ddae0/resourceGroups/ExampleRG/providers/Microsoft.Compute/virtualMachines/ExampleVM

You are done!