Azure RBAC and Azure IAM

Question

1. A user should be able to read a resource group. Not allowing the user to create/delete a resource group.

   i. I have created a custom role using json script with the following permissions:

    Actions: Microsoft.Resources/subscriptions/resourceGroups/read NotActions: Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete 

   ii. Added it using PowerShell cmdlet New-AzureRMRoleDefinition. But when I assigned this custom role to a user in IAM, user is still able to create/delete a resource group.

Note: I have used RBAC and IAM services of Azure

Answer 1

Go to resource group blade >> IAM >> Add (at the top of the blade).

Select contributor. Select User. you are done.