title: How to create an Azure custom role that allows registering applications and service principals
body: <p>I would like to create a <strong>least permission</strong> custom role in Azure to assign to a service principal that only allows the service principal to register Azure AD applications and service principals.</p>
  
  <p>The "Contributor" standard role has all the needed rights but also a great many that are not needed, and I can't find anything in the <a href="https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations" rel="nofollow noreferrer">list of available operations</a> that seems to correspond to application registrations which could be used to produce a custom role.</p>
  
  <hr>
  
  <p>It turns out the question is misguided - I had thought the assignment of Microsoft.Azure.ActiveDirectory permissions to the service principal was insufficient to create and edit app registrations.  But it turns out I was just running up against a 5-10 minute lag between permissions being set in the Azure portal and the permissions taking effect.  Granting the contributor role to the service principal just happened to take enough time for the original permissions to take effect.</p>