Custom roles are used to strengthen DNS Proxy application access rather than solely using Azure's built-in permissions. Follow the steps below to add a custom role assignment.
Go to your Microsoft Azure Portal .
In the top search bar, type subscriptions and select Subscriptions from the results.
Click on your subscription name and the Subscription page opens.
Select Access control (IAM) from the left-hand menu.
Click the Roles tab.
Click Add and select Add custom role from the drop-down menu.
On the Create a custom role page, click the JSON tab, and then click Edit.
Copy the following JSON and paste it into the text box, overwriting the existing JSON text
{ "properties": { "roleName": "AzureADAgent Resource Reader", "description": "Read ResourceGroups, Virtual Machine & Network Interface Data", "assignableScopes": [ "/subscriptions/3f51630f-4c88-4fba-b57a-5c39b5662a2f" ], "permissions": [ { "actions": [ "Microsoft.Network/virtualNetworks/read", "Microsoft.Network/networkInterfaces/read", "Microsoft.Network/networkInterfaces/diagnosticIdentity/read", "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/networkInterfaces/read", "Microsoft.Compute/virtualMachines/read", "Microsoft.Compute/virtualMachines/instanceView/read", "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read", "Microsoft.Resources/subscriptions/resourceGroups/read" ], "notActions": [], "dataActions": [], "notDataActions": [] } ] } }Click Next.
Click Create and you have now created a custom role named AzureADAgent Resource Reader.
Note
It can take a number of minutes for a custom role to propagate throughout the tenant.
Return to the Subscriptions page and select Access control (IAM) in the left-hand menu.
Click the Roles tab and in the search bar and enter AzureADAgent Resource Reader.
On the Subscriptions page, select Access control (IAM) in the left-hand menu and click Add Role Assignment. The Add role assignment window displays:
From the Role menu, select AzureAD Agent Resource Reader.
From the Assign access to menu, select User, group, or service principal.
From the Select menu, select DNSProxy.
Click Save.