Azure RBAC Calculator

utilisation = role assignments ÷ 4000 per subscription; a group assignment replaces one assignment per member, so savings = assignments × (members per group − 1). Azure counts each role assignment object against a per-subscription limit, and that limit is reached surprisingly often because assignments are made at resource-group and resource scope as well as subscription scope. Targeting a group instead of a user collapses many assignments into one without changing effective access.

When a subscription hits 4000 assignments, new access requests simply fail, and the fix — re-modelling hundreds of user assignments onto groups — is a project rather than a ticket.

This calculator takes 5 inputs: Role assignments in the subscription, Custom roles in the tenant, Subscriptions in the tenant, Assignments target groups rather than users, Average members per group. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Assign roles to Microsoft Entra groups instead of individual users, prefer assignments at management-group or subscription scope over dozens of resource-scope assignments, remove assignments for deleted principals, and use Privileged Identity Management for eligible rather than permanent access so short-lived assignments do not accumulate.

No. An assignment created at management-group scope is counted against that management group, not against every subscription beneath it — which is exactly why moving broad access up the hierarchy is the fastest way to reclaim subscription headroom.