Set-AzureRmADGroupRoleForResourceGroup.ps1

param(
    [Parameter(Mandatory=$true)]
    [string] $SecurityGroupName,
    
    [Parameter(Mandatory=$true)]
    [string] $RequiredAzureRoleName,
    
    [Parameter(Mandatory=$true)]
    [string] $ResourceGroupName
)

# Assumes that the context has already been set by:
# - Login-AzureRmAccount
# - Connect-MsolService

# Find the Security Group in Azure AD
$targetGroup = Get-MsolGroup -GroupType Security | Where-Object { $_.DisplayName -like "*$($SecurityGroupName)*" }

if($targetGroup -ne $null)
{
    # Locate the Resource Group we want to use as our scope
    $rg = Get-AzureRmResourceGroup -Name $ResourceGroupName
    
    if($rg -ne $null)
    {
        # Get Azure RBAC Role to assign to this scope
        $roleDef = Get-AzureRmRoleDefinition -Name $RequiredAzureRoleName

        # Assign the Group the Role for the Resource Group Scope specified.
        New-AzureRmRoleAssignment -ObjectId $targetGroup.ObjectId -RoleDefinitionId $roleDef.Id -Scope $rg.ResourceId
    }
    else
    {
        Write-Host "Couldn't find the specified resource group in the current subscription."
    }
}
else
{
    Write-Host "Couldn't find the required group in Azure Active Directory.".
}