Configure a policy-specific non-compliance message for the policy definition inside the CIS initiative that evaluates custom RBAC role usage. Azure Policy supports custom nonComplianceMessages on policy assignments. When the assignment is an initiative, Microsoft allows a separate message to be associated with an individual policy definition by specifying its policyDefinitionReferenceId. This makes it possible to show a customized message—such as instructions plus a link to an internal governance website—only when that specific policy is violated. Microsoft Learn

This is the least disruptive option because it does not alter messaging for the other policies contained in the CIS benchmark initiative. A default non-compliance message would apply broadly to policies in the assignment unless overridden, creating unnecessary impact on unrelated controls.

A remediation task is relevant to modify or deployIfNotExists scenarios and does not control the error text shown to users. Changing the policy effect controls enforcement behavior such as Audit or Deny, not the customized explanatory message itself. Microsoft states that custom non-compliance messages are displayed in deny error messages and in non-compliant resource results.