From azure
Provision and sync Azure IAM resources — Entra ID groups, role assignments at Management Group / Subscription / Resource Group scope, and Privileged Identity Management (PIM) eligible assignments — from a core-iam.yaml and tenant.yaml definition. Uses the Azure MCP server. Use when applying or updating IAM changes on Azure after running define-core-iam or define-tenant-iam.
How this skill is triggered — by the user, by Claude, or both
Slash command
/azure:manage-azure-iamThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Implementation
Implementation
Microsoft.Authorization/roleAssignments/write at the target scopeMicrosoft.Authorization/roleDefinitions/write (if custom roles are needed)Group.ReadWrite.All and Directory.ReadWrite.AllPrivilegedAccess.ReadWrite.AzureADGroup (for PIM configuration)design-segmentation).Apply the IAM definitions from core-iam.yaml and/or one or more tenants/{name}.yaml files to Azure. Ensure that:
Role("admin") and Tier("live") Role("contributor") groups.Role("operator") groups.Drift between the declared state and the live Azure state must be identified and resolved. This skill is idempotent: running it multiple times produces the same result.
When writing configurations or documentation, you MUST strictly adhere to the structural notation and types defined in the book. Before proceeding, read the following reference files:
references/notation.mdreferences/types.mdBefore proceeding, ask the user (or infer from context):
core-iam.yaml and/or tenants/{name}.yaml. Read these files first.platform-sandbox, ecommerce-live, rg-payments-eu01-live).Read the IAM definition files before proceeding. Do not apply changes based on assumptions about their contents.
Read the specified IAM definition files. Extract:
Role("operator") groupsjit_overrides in tenant files)Validate the definitions before applying:
Role("operator") groupsReport any validation errors and stop. Do not apply changes against an invalid definition.
For each group in the definition:
isAssignableToRole: true flag (required for PIM-eligible groups).Role("operator") groups: Verify that Role("operator") groups have zero human members. If any are found, report them and remove them.Map each group to the correct Azure built-in role and scope, derived from the coordinate system:
| Group Pattern | Azure Role | Scope |
|---|---|---|
{sector}-{tier}-operator | Role("contributor") | Subscription (sector, tier) |
{sector}-{tier}-admins | Owner | Subscription (sector, tier) |
{sector}-{tier}-contributors | Role("contributor") | Subscription (sector, tier) |
{sector}-{tier}-readers | Role("reader") | Management Group ({sector}) |
{tenant}-{tier}-operator | Role("contributor") | Resource Group (sector, tier, region, tenant) |
{tenant}-{tier}-admins | Owner | Resource Group(s) for tenant |
{tenant}-{tier}-contributors | Role("contributor") | Resource Group(s) for tenant |
{tenant}-readers | Role("reader") | Subscription (sector, tier) for each declared sector |
For each role assignment:
If custom roles are required (e.g., a narrower permission set than Role("contributor")), define them via the Azure MCP before creating the assignment. Document any custom role definitions in the output.
For every Role("admin") and Tier("live") Role("contributor") group (which use JIT escalation), configure PIM:
isAssignableToRole: true).admins or contributors.true for Tier("live") Role("admin") and peer-approval Role("contributor"); false for self-approve.max_duration_hours in the definition.true for Tier("live").Tier("live") Role("admin") roles.Tier("sandbox") Role("contributor") (self-approve, no justification), PIM eligible assignments are still recommended — but the activation policy can be permissive.Report the PIM assignment state after configuration.
For each Role("operator") group's Workload Identity definition:
Role("operator").issuer, subject, and audience.Role("operator") group's role assignment to this App Registration or Managed Identity (not to a human user).Do not create or store client secrets. If a client secret is found on an Role("operator") identity, report it as a security finding.
After applying changes, produce a summary:
Role("operator") groups, client secrets, wildcard subjects)If running in dry-run mode, produce this report without making any changes, and ask for confirmation before proceeding.
Produce a Markdown report named azure-iam-report.md:
``markdown
Date: [timestamp] Scope: [core / tenant names applied] Mode: [applied / dry-run]
| Group | Status | Members Added | Members Removed |
|---|---|---|---|
| platform-sandbox-readers | created | 4 | 0 |
| payments-live-admins | exists | 1 | 0 |
| Group | Role | Scope | Status |
|---|---|---|---|
| platform-sandbox-operator | Role("contributor") | /subscriptions/platform-sandbox | created |
| payments-readers | Role("reader") | /subscriptions/ecommerce-live | exists |
| Group | Member | Approval | Duration | Status |
|---|---|---|---|---|
| payments-live-admins | [email protected] | peer | 2h | created |
Role("operator") Group | App Registration | Subject | Status |
|---|---|---|---|
| payments-live-operator | payments-live-runner | repo:mountainlab/payments-service:environment:live | created |
[List any violations: human members in Role("operator") groups, client secrets found, wildcard subjects, etc.]
[Anything that could not be applied automatically and requires manual action] ``
Role("operator") identity, treat it as a security finding and recommend rotating to Workload Identity.Role("admin") and Tier("live") Role("contributor") groups must use PIM eligible assignments, not active assignments.This skill is grounded in Chapter 5: Identity and Access Management of Crafting Platforms.
npx claudepluginhub craftingplatforms/ai --plugin azureConfigures Microsoft Entra Privileged Identity Management for just-in-time role activation, approval workflows, and access reviews to replace standing privileged access.
Configures Microsoft Entra Privileged Identity Management for just-in-time role activation, approval workflows, and access reviews to replace standing privileged access.
Builds least-privilege IAM setups: roles, policies, service accounts for cloud services. Generates IaC using Terraform, Pulumi, CloudFormation.