Merge pull request #295213 from rolyon/rolyon-rbac-limits-assignments-custom-roles

[Azure RBAC] Role assignments and custom role limits update

Author: JamesJBarnett

articles/role-based-access-control/conditions-faq.md

@@ -6,7 +6,7 @@ manager: amycolannino
 ms.service: role-based-access-control
 ms.subservice: conditions
 ms.topic: conceptual
-ms.date: 05/09/2023
+ms.date: 02/26/2025
 ms.author: rolyon
 ---
 
@@ -63,7 +63,7 @@ A condition can be up to 8 KB long.
 
 **What are the limits for a description?**
 
-A description can be up to 2 KB long.
+A description has a recommended maximum of 512 characters.
 
 **Is it possible to create a role assignment with and without a condition, but using the same tuple of security principal, role definition, and scope?**
 

articles/role-based-access-control/custom-roles.md

@@ -5,7 +5,7 @@ author: rolyon
 manager: amycolannino
 ms.service: role-based-access-control
 ms.topic: conceptual
-ms.date: 02/22/2024
+ms.date: 02/26/2025
 ms.author: rolyon
 ---
 
@@ -141,10 +141,10 @@ The following table describes what the custom role properties mean.
 
 | Property | Required | Type | Description |
 | --- | --- | --- | --- |
-| `Name`</br>`roleName` | Yes | String | The display name of the custom role. While a role definition is a management group or subscription-level resource, a role definition can be used in multiple subscriptions that share the same Microsoft Entra tenant. This display name must be unique at the scope of the Microsoft Entra tenant. Can include letters, numbers, spaces, and special characters. Maximum number of characters is 512. |
+| `Name`</br>`roleName` | Yes | String | The display name of the custom role. While a role definition is a management group or subscription-level resource, a role definition can be used in multiple subscriptions that share the same Microsoft Entra tenant. This display name must be unique at the scope of the Microsoft Entra tenant. Can include letters, numbers, spaces, and special characters. Recommended maximum: 256 characters. |
 | `Id`</br>`name` | Yes | String | The unique ID of the custom role. For Azure PowerShell and Azure CLI, this ID is automatically generated when you create a new role. |
 | `IsCustom`</br>`roleType` | Yes | String | Indicates whether this is a custom role. Set to `true` or `CustomRole` for custom roles. Set to `false` or `BuiltInRole` for built-in roles. |
-| `Description`</br>`description` | Yes | String | The description of the custom role. Can include letters, numbers, spaces, and special characters. Maximum number of characters is 2048. |
+| `Description`</br>`description` | Yes | String | The description of the custom role. Can include letters, numbers, spaces, and special characters. Recommended maximum: 512 characters. |
 | `Actions`</br>`actions` | Yes | String[] | An array of strings that specifies the control plane actions that the role allows to be performed. For more information, see [Actions](role-definitions.md#actions). |
 | `NotActions`</br>`notActions` | No | String[] | An array of strings that specifies the control plane actions that are excluded from the allowed `Actions`. For more information, see [NotActions](role-definitions.md#notactions). |
 | `DataActions`</br>`dataActions` | No | String[] | An array of strings that specifies the data plane actions that the role allows to be performed to your data within that object. If you create a custom role with `DataActions`, that role can't be assigned at management group scope. For more information, see [DataActions](role-definitions.md#dataactions). |

articles/role-based-access-control/whats-new.md

@@ -18,6 +18,7 @@ This article provides information about new features and documentation improveme
 
 | Date | Area | Description |
 | --- | --- | --- |
+| February 2025 | Limits | Updates to [Azure RBAC limits](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-rbac-limits). |
 | February 2025 | Roles | Added [Chaos Studio Target Contributor](built-in-roles/devops.md#chaos-studio-target-contributor) role. |
 | February 2025 | Security | Added instructions for how to detect elevate access events using Microsoft Sentinel. See [Detect elevate access events using Microsoft Sentinel](elevate-access-global-admin.md#detect-elevate-access-events-using-microsoft-sentinel). |
 | February 2025 | Permissions | Updated list of permissions for the Azure Container Registry. See [Microsoft.ContainerRegistry](permissions/containers.md#microsoftcontainerregistry). |

includes/role-based-access-control/limits.md

@@ -4,21 +4,22 @@
  author: rolyon
  ms.service: role-based-access-control
  ms.topic: include
- ms.date: 04/19/2023
+ ms.date: 02/26/2025
  ms.author: rolyon
  ms.custom: include file
 ---
 
 | Area | Resource | Limit |
 | --- | --- | --- |
 | [Azure role assignments](../../articles/role-based-access-control/overview.md) |  |  |
-|  | Azure role assignments per Azure subscription | 4,000 |
-|  | Azure role assignments per management group | 500 |
-|  | Size of description for Azure role assignments | 2 KB |
+|  | Number of Azure role assignments per Azure subscription | 4,000 |
+|  | Number of Azure role assignments per management group | 500 |
+|  | Size of description for Azure role assignments | Recommended maximum: 512 chars |
 |  | Size of [condition](../../articles/role-based-access-control/conditions-overview.md) for Azure role assignments | 8 KB |
 | [Azure custom roles](../../articles/role-based-access-control/custom-roles.md) |  |  |
-|  | Azure custom roles per tenant | 5,000 |
-|  | Azure custom roles per tenant<br/>(for Microsoft Azure operated by 21Vianet) | 2,000 |
-|  | Size of role name for Azure custom roles | 512 chars |
-|  | Size of description for Azure custom roles | 2 KB |
+|  | Number of Azure custom roles per tenant | 5,000 |
+|  | Number of Azure custom roles per tenant<br/>(for Microsoft Azure operated by 21Vianet) | 2,000 |
+|  | Size of role name for Azure custom roles | Recommended maximum: 256 chars |
+|  | Size of description for Azure custom roles | Recommended maximum: 512 chars |
+|  | Size of an Azure custom role definition | 1 MB |
 |  | Number of assignable scopes for Azure custom roles | 2,000 |