Custom roles

You can also create custom roles in RBAC when none of the built-in roles suit your needs. Custom roles can be assigned to the exact same resources as built-in roles and can only be created using PowerShell, the CLI, and the REST API. You can't create them in the Azure portal. In each Azure tenant, you can create up to 2,000 roles.

Custom roles are defined in JSON, and after deployment, they are stored inside the Azure AD tenant. By storing them inside the Azure AD tenant, they can be used in all the different Azure subscriptions that are connected to the Azure AD tenant.