Repository navigation
az role definition create --role-definition example fails #15370
Description
az feedbackauto-generates most of the information requested below, as of CLI version 2.0.62
Describe the bug
When trying to create a new custom role definition using Cloud Shell Azure CLI, my script keeps failing.
I have tried to use the the example from the az role definition create --role-definition section in the Docs page, but also get an error here. All other examples I have located, utilize an external JSON file, and I like to use the script with embedded JSON code, for easier management and documentation.
Reference:
az role definition
https://docs.microsoft.com/en-us/cli/azure/role/definition?view=azure-cli-latest#az_role_definition_create
Example code (subscription id replaced with id from my tenant):
az role definition create --role-definition '{
"Name": "Contoso On-call",
"Description": "Perform VM actions and read storage and network information.",
"Actions": [
"Microsoft.Compute/*/read",
"Microsoft.Compute/virtualMachines/start/action",
"Microsoft.Compute/virtualMachines/restart/action",
"Microsoft.Network/*/read",
"Microsoft.Storage/*/read",
"Microsoft.Authorization/*/read",
"Microsoft.Resources/subscriptions/resourceGroups/read",
"Microsoft.Resources/subscriptions/resourceGroups/resources/read",
"Microsoft.Insights/alertRules/*",
"Microsoft.Support/*"
],
"DataActions": [
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/*"
],
"NotDataActions": [
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write"
],
"AssignableScopes": ["/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"]
}'
The script produces this error:
ArgumentParseError: unrecognized arguments: On-call,
Description: Perform VM actions and read storage and network information.,
Actions: [
Microsoft.Compute/*/read,
Microsoft.Compute/virtualMachines/start/action,
Microsoft.Compute/virtualMachines/restart/action,
Microsoft.Network/*/read,
Microsoft.Storage/*/read,
Microsoft.Authorization/*/read,
Microsoft.Resources/subscriptions/resourceGroups/read,
Microsoft.Resources/subscriptions/resourceGroups/resources/read,
Microsoft.Insights/alertRules/*,
Microsoft.Support/*
],
DataActions: [
Microsoft.Storage/storageAccounts/blobServices/containers/blobs
...
The example in the documentation is expected to be usable in any subscription, just with a custom subscription ID added.
Used environment is the Cloud Shell Azure CLI in PowerShell mode.
Activity
yonzhan commentedon Sep 30, 2020
add to S177
16 remaining items
teresaritorto commentedon Oct 8, 2026
Closing as a shell-quoting behavior rather than a CLI defect.
If
az role definition createstill fails on current CLI with input that PowerShell passes as a single argument, please open a fresh issue