Explanation

Step 1: Modify the permissions section of the JSON file
Step 2: Modify the assignableScopes section of the JSON file.
Replace <SubscriptionID> with your Azure subscription ID.
Sample JSON file:
{
"Name": "Azure Stack Hub registration role",
"Id": null,
"IsCustom": true,
"Description": "Allows access to register Azure Stack Hub",
"Actions": [
"Microsoft.Resources/subscriptions/resourceGroups/write",
"Microsoft.Resources/subscriptions/resourceGroups/read",
"Microsoft.AzureStack/registrations/*",
"Microsoft.AzureStack/register/action",
"Microsoft.Authorization/roleAssignments/read",
"Microsoft.Authorization/roleAssignments/write",
"Microsoft.Authorization/roleAssignments/delete",
"Microsoft.Authorization/permissions/read",
"Microsoft.Authorization/locks/read",
"Microsoft.Authorization/locks/write"
],
"NotActions": [
],
"AssignableScopes": [
"/subscriptions/<SubscriptionID>"
]
}
Step 3: Connect to the administrator Azure Resource Manager (ARM) endpoint.
In PowerShell, connect to Azure to use Azure Resource Manager. When prompted, authenticate using an account with sufficient permissions such as Owner or User Access Administrator.
Connect-AzAccount
Step 4: Run the New-AzRoleDefinition cmdlet.
To create the custom role, use New-AzRoleDefinition specifying the JSON template file.
New-AzRoleDefinition -InputFile "C:\CustomRoles\registrationrole.json
Reference: https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-registration-role