Install
/plugin marketplace add microsoft/azure-skills
$
This skill finds the least-privilege Azure RBAC role that matches the permissions an identity needs, falling back to a custom role definition when no built-in role fits. It then generates the az CLI commands and a Bicep snippet to assign that role. It also explains the prerequisites for granting roles, such as needing User Access Administrator. Use it for questions like what role should I assign or a role to read blobs.