An RBAC role without permission to create or assign public IP addresses

azure-rbac-role-without-public-ip.json

{
    "Name":  "Reduced contributor",
    "Description":  "Lets you manage everytime except access and public ip addresses",
    "Actions":  [
                    "*"
                ],
    "NotActions":  [
                       "Microsoft.Authorization/*/Delete",
                       "Microsoft.Authorization/*/Write",
                       "Microsoft.Authorization/elevateAccess/Action",
                       "Microsoft.Blueprint/blueprintAssignments/write",
                       "Microsoft.Blueprint/blueprintAssignments/delete",
                       "Microsoft.Network/publicIPAddresses/join/action",
                       "Microsoft.Network/publicIPAddresses/write"
                   ],
    "DataActions":  [

                    ],
    "NotDataActions":  [

                       ],
    "AssignableScopes":  [
                             "/"
                         ]
}