There is a command group 'az_role_assignment'. This group of commands could 'manage role assignments'. The group of commands has global parameter '--debug' which means 'Increase logging verbosity to show all debug logs.'. The group of commands has global parameter '--help -h' which means 'Show this help message and exit.'. The group of commands has global parameter '--only-show-errors' which means 'Only show errors, suppressing warnings.'. The group of commands has global parameter '--output -o' which means 'Output format.'. The group of commands has global parameter '--query' which means 'JMESPath query string. See <a href="http://jmespath.org/">http://jmespath.org/</a> for more information and examples.'. The group of commands has global parameter '--subscription' which means 'Name or ID of subscription. You can configure the default subscription using `az account set -s NAME_OR_ID`.'. The group of commands has global parameter '--verbose' which means 'Increase logging verbosity. Use --debug for full debug logs.'. This group contains a child command 'az_role_assignment_create'.The syntax is: az role assignment create --role
                          --scope
                          [--assignee]
                          [--assignee-object-id]
                          [--name]. The 1th example of the child command would be to use it to 'create role assignment to grant the specified assignee the reader role on an azure virtual machine', the syntax is: az role assignment create --assignee sp_name --role Reader --scope /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/MyResourceGroup/providers/Microsoft.Compute/virtualMachines/MyVm. The 2th example of the child command would be to use it to 'create role assignment with your own assignment name', the syntax is: az role assignment create --assignee-object-id 00000000-0000-0000-0000-000000000000 --assignee-principal-type ServicePrincipal --role Reader --scope /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/MyResourceGroup --name 00000000-0000-0000-0000-000000000000. The parameter '--role' is required. It is used to role name or id.. The parameter '--scope' is required. It is used to scope at which the role assignment or definition applies to, e.g., /subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333, /subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333/resourcegroups/mygroup, or /subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333/resourcegroups/mygroup/providers/microsoft.compute/virtualmachines/myvm.. The parameter '--assignee' is optional. represent a user, group, or service principal. supported format: object id, user sign-in name, or service principal name.. The parameter '--assignee-object-id' is optional. use this parameter instead of '--assignee' to bypass graph api invocation in case of insufficient privileges. this parameter only works with object ids for users, groups, service principals, and managed identities. for managed identities use the principal id. for service principals, use the object id and not the app id.. The parameter '--name -n' is optional. a guid for the role assignment. it must be unique and different for each role assignment. if omitted, a new guid is generetd.. 