We have a VNET that is coupled to an Express route, on which we will give our users access to specific subnets.

These subnets are created for each resource group, and the idea is to have these users only able to add machines in their subnet.
To allow users to add machines to a subnet I gave them the following permissions:

  • Read on Virtual Network
  • Contributor on their subnet

However this allowed the users to select all subnets on the virtual network.
It simply throws an error when you try to deploy a machine on a subnet you lack contributor on.

I tried creating custom roles, but if I am to create one that only disallows reading as such:

    "Name":  "Not Reader",
    "Description":  "Denies Reader priviliges on the assigned resource.",
    "Actions":  [
    "NotActions":  [
    "AssignableScopes":  [

I get the error:

New-AzureRmRoleDefinition : Invalid value for Actions
At line:1 char:1
+ New-AzureRmRoleDefinition -InputFile C:\temp\customroles\NotReader.json
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [New-AzureRmRoleDefinition], ArgumentException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.Resources.NewAzureRoleDefinitionCommand

I assume this is because the actions value can not be empty.
I'm not sure what I should/could safely add in the actions, and at this point it's starting to look like I'm putting together something complex for what should be quite simple.

So how should I set up/create roles to allow for a user to see and utilize only a single subnet within a larger VNET?

  • What is it your trying to achieve here, it seems overly complicated. If you only want users to be able to create VM's in specific subnets it sounds like you already achieved that. If you want users not to be able to see what machines are in other subnets then I don't think this is the right method. Even if you do manage to prevent this in the portal, the machines on different subnets can still communicate, users can still gather this data through network tools. If you want to complete separate your teams, then you need separate VNets. – Sam Cogan Oct 26 '16 at 10:53
  • @Sam I want people to be able to see only the subnets they are allowed to create machines in. We already have network security groups in place to prevent communication between subnets. the main problem is that users are presented with a large list of subnets, while they only have access to one. – Reaces Oct 26 '16 at 11:00
  • How many subnets are you talking about? If it's a small number it would be easier to create them as separate VNet's if your not going to allow communication between them anyway – Sam Cogan Oct 26 '16 at 11:01
  • @Sam Creating the subnets is scripted, and the idea is to allow different divisions to be in control of creating their own resource groups with subnet ranges defined by the scripting, currently there are 30, and probably more incoming. – Reaces Oct 26 '16 at 11:04

We can not put restrictions on a specific subnet. I had the same issue.

The custom rules can only be applied on 1) Resource Groups 2) Resource (vnet is a resource and not subnets, subnets are the outcome of a resource) 3) Subscription

As explained, subnets are not resources and you will not be able to restrict which subnets can and cannot be used, via RBAC/Custom roles feature.

You might have to look into Azure Blueprints or Azure policies for that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.