Microsoft's edit · Azure built-in roles · devops

77 author: rolyon

88 manager: pmwongera

99 ms.author: rolyon

10 −ms.date: 02/23/2026

11 −ms.custom: generated

12 −---

13 −

14 −# Azure built-in roles for DevOps

15 −

16 −This article lists the Azure built-in roles in the DevOps category.

17 −

18 −

19 −## Chaos Studio Experiment Contributor

20 −

21 −Can create, run, and see details for experiments, onboard targets, and manage capabilities.

22 −

23 −[Learn more](/azure/chaos-studio/chaos-studio-permissions-security)

24 −

25 −> [!div class="mx-tableFixed"]

26 −> | Actions | Description |

27 −> | --- | --- |

28 −> | [Microsoft.Chaos](../permissions/devops.md#microsoftchaos)/* | |

29 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

30 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

31 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

32 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

33 −> | **NotActions** | |

34 −> | *none* | |

35 −> | **DataActions** | |

36 −> | *none* | |

37 −> | **NotDataActions** | |

38 −> | *none* | |

39 −

40 −```json

41 −{

42 − "assignableScopes": [

43 − "/"

44 − ],

45 − "description": "Can create, run, and see details for experiments, onboard targets, and manage capabilities.",

46 − "id": "/providers/Microsoft.Authorization/roleDefinitions/7c2e40b7-25eb-482a-82cb-78ba06cb46d5",

47 − "name": "7c2e40b7-25eb-482a-82cb-78ba06cb46d5",

48 − "permissions": [

49 − {

50 − "actions": [

51 − "Microsoft.Chaos/*",

52 − "Microsoft.Authorization/*/read",

53 − "Microsoft.Insights/alertRules/*",

54 − "Microsoft.Resources/deployments/*",

55 − "Microsoft.Resources/subscriptions/resourceGroups/read"

56 − ],

57 − "notActions": [],

58 − "dataActions": [],

59 − "notDataActions": []

60 − }

61 − ],

62 − "roleName": "Chaos Studio Experiment Contributor",

63 − "roleType": "BuiltInRole",

64 − "type": "Microsoft.Authorization/roleDefinitions"

65 −}

66 −```

67 −

68 −## Chaos Studio Operator

69 −

70 −Can run and see details for experiments but cannot create experiments or manage targets and capabilities.

71 −

72 −[Learn more](/azure/chaos-studio/chaos-studio-permissions-security)

73 −

74 −> [!div class="mx-tableFixed"]

75 −> | Actions | Description |

76 −> | --- | --- |

77 −> | [Microsoft.Chaos](../permissions/devops.md#microsoftchaos)/*/read | |

78 −> | [Microsoft.Chaos](../permissions/devops.md#microsoftchaos)/experiments/start/action | Starts a Chaos Experiment to inject faults. |

79 −> | [Microsoft.Chaos](../permissions/devops.md#microsoftchaos)/experiments/cancel/action | Cancels a running Chaos Experiment to stop the fault injection. |

80 −> | [Microsoft.Chaos](../permissions/devops.md#microsoftchaos)/experiments/executions/getExecutionDetails/action | Gets details of a chaos experiment execution for a given chaos experiment. |

81 −> | [Microsoft.Chaos](../permissions/devops.md#microsoftchaos)/locations/operationResults/read | Gets an Operation Result. |

82 −> | [Microsoft.Chaos](../permissions/devops.md#microsoftchaos)/locations/operationStatuses/read | Gets an Operation Status. |

83 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

84 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

85 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

86 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

87 −> | **NotActions** | |

88 −> | *none* | |

89 −> | **DataActions** | |

90 −> | *none* | |

91 −> | **NotDataActions** | |

92 −> | *none* | |

93 −

94 −```json

95 −{

96 − "assignableScopes": [

97 − "/"

98 − ],

99 − "description": "Can run and see details for experiments but cannot create experiments or manage targets and capabilities.",

100 − "id": "/providers/Microsoft.Authorization/roleDefinitions/1a40e87e-6645-48e0-b27a-0b115d849a20",

101 − "name": "1a40e87e-6645-48e0-b27a-0b115d849a20",

102 − "permissions": [

103 − {

104 − "actions": [

105 − "Microsoft.Chaos/*/read",

106 − "Microsoft.Chaos/experiments/start/action",

107 − "Microsoft.Chaos/experiments/cancel/action",

108 − "Microsoft.Chaos/experiments/executions/getExecutionDetails/action",

109 − "Microsoft.Chaos/locations/operationResults/read",

110 − "Microsoft.Chaos/locations/operationStatuses/read",

111 − "Microsoft.Authorization/*/read",

112 − "Microsoft.Insights/alertRules/*",

113 − "Microsoft.Resources/deployments/*",

114 − "Microsoft.Resources/subscriptions/resourceGroups/read"

115 − ],

116 − "notActions": [],

117 − "dataActions": [],

118 − "notDataActions": []

119 − }

120 − ],

121 − "roleName": "Chaos Studio Operator",

122 − "roleType": "BuiltInRole",

123 − "type": "Microsoft.Authorization/roleDefinitions"

124 −}

125 −```

126 −

127 −## Chaos Studio Reader

128 −

129 −Can view targets, capabilities, experiments, and experiment details.

130 −

131 −[Learn more](/azure/chaos-studio/chaos-studio-permissions-security)

132 −

133 −> [!div class="mx-tableFixed"]

134 −> | Actions | Description |

135 −> | --- | --- |

136 −> | [Microsoft.Chaos](../permissions/devops.md#microsoftchaos)/*/read | |

137 −> | [Microsoft.Chaos](../permissions/devops.md#microsoftchaos)/experiments/executions/getExecutionDetails/action | Gets details of a chaos experiment execution for a given chaos experiment. |

138 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

139 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

140 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

141 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

142 −> | **NotActions** | |

143 −> | *none* | |

144 −> | **DataActions** | |

145 −> | *none* | |

146 −> | **NotDataActions** | |

147 −> | *none* | |

148 −

149 −```json

150 −{

151 − "assignableScopes": [

152 − "/"

153 − ],

154 − "description": "Can view targets, capabilities, experiments, and experiment details.",

155 − "id": "/providers/Microsoft.Authorization/roleDefinitions/29e2da8a-229c-4157-8ae8-cc72fc506b74",

156 − "name": "29e2da8a-229c-4157-8ae8-cc72fc506b74",

157 − "permissions": [

158 − {

159 − "actions": [

160 − "Microsoft.Chaos/*/read",

161 − "Microsoft.Chaos/experiments/executions/getExecutionDetails/action",

162 − "Microsoft.Authorization/*/read",

163 − "Microsoft.Insights/alertRules/*",

164 − "Microsoft.Resources/deployments/*",

165 − "Microsoft.Resources/subscriptions/resourceGroups/read"

166 − ],

167 − "notActions": [],

168 − "dataActions": [],

169 − "notDataActions": []

170 − }

171 − ],

172 − "roleName": "Chaos Studio Reader",

173 − "roleType": "BuiltInRole",

174 − "type": "Microsoft.Authorization/roleDefinitions"

175 −}

176 −```

177 −

178 −## Chaos Studio Target Contributor

179 −

180 −Can onboard targets and manage capabilities but cannot create, run, or see details for experiments

181 −

182 −[Learn more](/azure/chaos-studio/chaos-studio-permissions-security)

183 −

184 −> [!div class="mx-tableFixed"]

185 −> | Actions | Description |

186 −> | --- | --- |

187 −> | [Microsoft.Chaos](../permissions/devops.md#microsoftchaos)/targets/write | Creates or update a Target resource that extends a tracked resource. |

188 −> | [Microsoft.Chaos](../permissions/devops.md#microsoftchaos)/targets/delete | Deletes a Target resource that extends a tracked resource. |

189 −> | [Microsoft.Chaos](../permissions/devops.md#microsoftchaos)/targets/read | Gets all Targets that extend a tracked resource. |

190 −> | [Microsoft.Chaos](../permissions/devops.md#microsoftchaos)/targets/capabilities/write | Creates or update a Capability resource that extends a Target resource. |

191 −> | [Microsoft.Chaos](../permissions/devops.md#microsoftchaos)/targets/capabilities/delete | Deletes a Capability resource that extends a Target resource. |

192 −> | [Microsoft.Chaos](../permissions/devops.md#microsoftchaos)/targets/capabilities/read | Gets all Capabilities that extend a Target resource. |

193 −> | [Microsoft.Chaos](../permissions/devops.md#microsoftchaos)/locations/targetTypes/read | Gets all TargetTypes. |

194 −> | [Microsoft.Chaos](../permissions/devops.md#microsoftchaos)/locations/targetTypes/capabilityTypes/read | Gets all CapabilityType. |

195 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

196 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

197 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

198 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

199 −> | **NotActions** | |

200 −> | *none* | |

201 −> | **DataActions** | |

202 −> | *none* | |

203 −> | **NotDataActions** | |

204 −> | *none* | |

205 −

206 −```json

207 −{

208 − "assignableScopes": [

209 − "/"

210 − ],

211 − "description": "Can onboard targets and manage capabilities but cannot create, run, or see details for experiments",

212 − "id": "/providers/Microsoft.Authorization/roleDefinitions/59a618e3-3c9a-406e-9f03-1a20dd1c55f1",

213 − "name": "59a618e3-3c9a-406e-9f03-1a20dd1c55f1",

214 − "permissions": [

215 − {

216 − "actions": [

217 − "Microsoft.Chaos/targets/write",

218 − "Microsoft.Chaos/targets/delete",

219 − "Microsoft.Chaos/targets/read",

220 − "Microsoft.Chaos/targets/capabilities/write",

221 − "Microsoft.Chaos/targets/capabilities/delete",

222 − "Microsoft.Chaos/targets/capabilities/read",

223 − "Microsoft.Chaos/locations/targetTypes/read",

224 − "Microsoft.Chaos/locations/targetTypes/capabilityTypes/read",

225 − "Microsoft.Authorization/*/read",

226 − "Microsoft.Insights/alertRules/*",

227 − "Microsoft.Resources/deployments/*",

228 − "Microsoft.Resources/subscriptions/resourceGroups/read"

229 − ],

230 − "notActions": [],

231 − "dataActions": [],

232 − "notDataActions": []

233 − }

234 − ],

235 − "roleName": "Chaos Studio Target Contributor",

236 − "roleType": "BuiltInRole",

237 − "type": "Microsoft.Authorization/roleDefinitions"

238 −}

239 −```

240 −

241 −## Deployment Environments Reader

242 −

243 −Provides read access to environment resources.

244 −

245 −[Learn more](/azure/deployment-environments/how-to-manage-deployment-environments-access)

246 −

247 −> [!div class="mx-tableFixed"]

248 −> | Actions | Description |

249 −> | --- | --- |

250 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/read | Gets a specific project. |

251 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/*/read | |

252 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

253 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

254 −> | **NotActions** | |

255 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/pools/read | Gets a machine pool |

256 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/pools/schedules/read | Gets a schedule resource. |

257 −> | **DataActions** | |

258 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/adminRead/action | Allows a project administrator to read all of the environments in a project. |

259 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/adminActionRead/action | Allows an admin to read environment actions. |

260 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/adminOutputsRead/action | Allows an admin to read Output values from environment deployment. |

261 −> | **NotDataActions** | |

262 −> | *none* | |

263 −

264 −```json

265 −{

266 − "assignableScopes": [

267 − "/"

268 − ],

269 − "description": "Provides read access to environment resources.",

270 − "id": "/providers/Microsoft.Authorization/roleDefinitions/eb960402-bf75-4cc3-8d68-35b34f960f72",

271 − "name": "eb960402-bf75-4cc3-8d68-35b34f960f72",

272 − "permissions": [

273 − {

274 − "actions": [

275 − "Microsoft.DevCenter/projects/read",

276 − "Microsoft.DevCenter/projects/*/read",

277 − "Microsoft.Authorization/*/read",

278 − "Microsoft.Resources/subscriptions/resourceGroups/read"

279 − ],

280 − "notActions": [

281 − "Microsoft.DevCenter/projects/pools/read",

282 − "Microsoft.DevCenter/projects/pools/schedules/read"

283 − ],

284 − "dataActions": [

285 − "Microsoft.DevCenter/projects/users/environments/adminRead/action",

286 − "Microsoft.DevCenter/projects/users/environments/adminActionRead/action",

287 − "Microsoft.DevCenter/projects/users/environments/adminOutputsRead/action"

288 − ],

289 − "notDataActions": []

290 − }

291 − ],

292 − "roleName": "Deployment Environments Reader",

293 − "roleType": "BuiltInRole",

294 − "type": "Microsoft.Authorization/roleDefinitions"

295 −}

296 −```

297 −

298 −## Deployment Environments User

299 −

300 −Provides access to manage environment resources.

301 −

302 −[Learn more](/azure/deployment-environments/how-to-manage-deployment-environments-access)

303 −

304 −> [!div class="mx-tableFixed"]

305 −> | Actions | Description |

306 −> | --- | --- |

307 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/read | Gets a specific project. |

308 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/*/read | |

309 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

310 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

311 −> | **NotActions** | |

312 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/pools/read | Gets a machine pool |

313 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/pools/schedules/read | Gets a schedule resource. |

314 −> | **DataActions** | |

315 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/userRead/action | Allows a user to read the environments they have access to in a project. |

316 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/userWrite/action | Allows a user to write the environments they have access to in a project. |

317 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/userDelete/action | Allows a user to delete the environments they have access to in a project. |

318 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/userActionManage/action | Allows a user to skip, delay etc. environment actions. |

319 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/userOutputsRead/action | Allows a user to read Output values from environment deployment. |

320 −> | **NotDataActions** | |

321 −> | *none* | |

322 −

323 −```json

324 −{

325 − "assignableScopes": [

326 − "/"

327 − ],

328 − "description": "Provides access to manage environment resources.",

329 − "id": "/providers/Microsoft.Authorization/roleDefinitions/18e40d4e-8d2e-438d-97e1-9528336e149c",

330 − "name": "18e40d4e-8d2e-438d-97e1-9528336e149c",

331 − "permissions": [

332 − {

333 − "actions": [

334 − "Microsoft.DevCenter/projects/read",

335 − "Microsoft.DevCenter/projects/*/read",

336 − "Microsoft.Resources/subscriptions/resourceGroups/read",

337 − "Microsoft.Authorization/*/read"

338 − ],

339 − "notActions": [

340 − "Microsoft.DevCenter/projects/pools/read",

341 − "Microsoft.DevCenter/projects/pools/schedules/read"

342 − ],

343 − "dataActions": [

344 − "Microsoft.DevCenter/projects/users/environments/userRead/action",

345 − "Microsoft.DevCenter/projects/users/environments/userWrite/action",

346 − "Microsoft.DevCenter/projects/users/environments/userDelete/action",

347 − "Microsoft.DevCenter/projects/users/environments/userActionManage/action",

348 − "Microsoft.DevCenter/projects/users/environments/userOutputsRead/action"

349 − ],

350 − "notDataActions": []

351 − }

352 − ],

353 − "roleName": "Deployment Environments User",

354 − "roleType": "BuiltInRole",

355 − "type": "Microsoft.Authorization/roleDefinitions"

356 −}

357 −```

358 −

359 −## DevCenter Dev Box User

360 −

361 −Provides access to create and manage dev boxes.

362 −

363 −[Learn more](/azure/dev-box/how-to-dev-box-user)

364 −

365 −> [!div class="mx-tableFixed"]

366 −> | Actions | Description |

367 −> | --- | --- |

368 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/read | Gets a specific project. |

369 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/*/read | |

370 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

371 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

372 −> | **NotActions** | |

373 −> | *none* | |

374 −> | **DataActions** | |

375 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userStop/action | Allows a user to stop their own Dev Box resources. |

376 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userStart/action | Allows a user to start their own Dev Box resources. |

377 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userGetRemoteConnection/action | Allows a user to get the RDP connection information for their own Dev Box resources. |

378 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userRead/action | Allows a user to read their own Dev Box resources. |

379 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userWrite/action | Allows a user to create and update their own Dev Box resources. |

380 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userDelete/action | Allows a user to delete their own Dev Box resources. |

381 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userUpcomingActionRead/action | Allows a user to read upcoming actions. |

382 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userUpcomingActionManage/action | Allows a user to skip or delay upcoming actions. |

383 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userActionRead/action | Allows a user to read dev box actions. |

384 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userActionManage/action | Allows a user to skip or delay dev box actions. |

385 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userCustomize/action | Allows a user to customize their own Dev Box resources. |

386 −> | **NotDataActions** | |

387 −> | *none* | |

388 −

389 −```json

390 −{

391 − "assignableScopes": [

392 − "/"

393 − ],

394 − "description": "Provides access to create and manage dev boxes.",

395 − "id": "/providers/Microsoft.Authorization/roleDefinitions/45d50f46-0b78-4001-a660-4198cbe8cd05",

396 − "name": "45d50f46-0b78-4001-a660-4198cbe8cd05",

397 − "permissions": [

398 − {

399 − "actions": [

400 − "Microsoft.DevCenter/projects/read",

401 − "Microsoft.DevCenter/projects/*/read",

402 − "Microsoft.Authorization/*/read",

403 − "Microsoft.Resources/subscriptions/resourceGroups/read"

404 − ],

405 − "notActions": [],

406 − "dataActions": [

407 − "Microsoft.DevCenter/projects/users/devboxes/userStop/action",

408 − "Microsoft.DevCenter/projects/users/devboxes/userStart/action",

409 − "Microsoft.DevCenter/projects/users/devboxes/userGetRemoteConnection/action",

410 − "Microsoft.DevCenter/projects/users/devboxes/userRead/action",

411 − "Microsoft.DevCenter/projects/users/devboxes/userWrite/action",

412 − "Microsoft.DevCenter/projects/users/devboxes/userDelete/action",

413 − "Microsoft.DevCenter/projects/users/devboxes/userUpcomingActionRead/action",

414 − "Microsoft.DevCenter/projects/users/devboxes/userUpcomingActionManage/action",

415 − "Microsoft.DevCenter/projects/users/devboxes/userActionRead/action",

416 − "Microsoft.DevCenter/projects/users/devboxes/userActionManage/action",

417 − "Microsoft.DevCenter/projects/users/devboxes/userCustomize/action"

418 − ],

419 − "notDataActions": []

420 − }

421 − ],

422 − "roleName": "DevCenter Dev Box User",

423 − "roleType": "BuiltInRole",

424 − "type": "Microsoft.Authorization/roleDefinitions"

425 −}

426 −```

427 −

428 −## DevCenter Owner

429 −

430 −Provides access to manage all Microsoft.DevCenter resources, and to manage access to Microsoft.DevCenter resources by adding or removing role assignments for the DevCenter Project Admin and DevCenter Dev Box roles.

431 −

432 −Includes an ABAC condition to constrain role assignments.

433 −

434 −[Learn more](/azure/dev-box/how-to-manage-dev-center)

435 −

436 −> [!div class="mx-tableFixed"]

437 −> | Actions | Description |

438 −> | --- | --- |

439 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/* | |

440 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

441 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/write | Create a role assignment at the specified scope. |

442 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/delete | Delete a role assignment at the specified scope. |

443 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

444 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

445 −> | **NotActions** | |

446 −> | *none* | |

447 −> | **DataActions** | |

448 −> | *none* | |

449 −> | **NotDataActions** | |

450 −> | *none* | |

451 −> | **Condition** | |

452 −> | ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{331c37c6-af14-46d9-b9f4-e1909e1b95a0, 45d50f46-0b78-4001-a660-4198cbe8cd05})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{331c37c6-af14-46d9-b9f4-e1909e1b95a0, 45d50f46-0b78-4001-a660-4198cbe8cd05})) | Add or remove role assignments for the following roles:<br/>DevCenter Project Admin<br/>DevCenter Dev Box User |

453 −

454 −```json

455 −{

456 − "assignableScopes": [

457 − "/"

458 − ],

459 − "description": "Provides access to manage all Microsoft.DevCenter resources, and to manage access to Microsoft.DevCenter resources by adding or removing role assignments for the DevCenter Project Admin and DevCenter Dev Box roles.",

460 − "id": "/providers/Microsoft.Authorization/roleDefinitions/4c6569b6-f23e-4295-9b90-bd4cc4ff3292",

461 − "name": "4c6569b6-f23e-4295-9b90-bd4cc4ff3292",

462 − "permissions": [

463 − {

464 − "actions": [

465 − "Microsoft.DevCenter/*",

466 − "Microsoft.Authorization/*/read",

467 − "Microsoft.Authorization/roleAssignments/write",

468 − "Microsoft.Authorization/roleAssignments/delete",

469 − "Microsoft.Resources/deployments/*",

470 − "Microsoft.Resources/subscriptions/resourceGroups/read"

471 − ],

472 − "notActions": [],

473 − "dataActions": [],

474 − "notDataActions": [],

475 − "conditionVersion": "2.0",

476 − "condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{331c37c6-af14-46d9-b9f4-e1909e1b95a0, 45d50f46-0b78-4001-a660-4198cbe8cd05})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{331c37c6-af14-46d9-b9f4-e1909e1b95a0, 45d50f46-0b78-4001-a660-4198cbe8cd05}))"

477 − }

478 − ],

479 − "roleName": "DevCenter Owner",

480 − "roleType": "BuiltInRole",

481 − "type": "Microsoft.Authorization/roleDefinitions"

482 −}

483 −```

484 −

485 −## DevCenter Project Admin

486 −

487 −Provides access to manage project resources.

488 −

489 −[Learn more](/azure/dev-box/how-to-project-admin)

490 −

491 −> [!div class="mx-tableFixed"]

492 −> | Actions | Description |

493 −> | --- | --- |

494 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/* | |

495 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

496 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

497 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

498 −> | **NotActions** | |

499 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/write | Partially updates a project. |

500 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/delete | Deletes a project resource. |

501 −> | **DataActions** | |

502 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/adminStart/action | Allows a user to start any Dev Box resource. |

503 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/adminStop/action | Allows a user to stop any Dev Box resource. |

504 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/adminRead/action | Allows a user read access to any Dev Box resource. |

505 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/adminWrite/action | Allows a user write access to any Dev Box resource. |

506 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/adminDelete/action | Allows a user to delete any Dev Box resource. |

507 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/adminAlign/action | Allows an admin to align a Dev Box with the pool configuration. |

508 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/adminActionRead/action | Allows an admin to read dev box actions. |

509 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/adminActionManage/action | Allows an admin to skip or delay dev box actions. |

510 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userStop/action | Allows a user to stop their own Dev Box resources. |

511 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userStart/action | Allows a user to start their own Dev Box resources. |

512 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userGetRemoteConnection/action | Allows a user to get the RDP connection information for their own Dev Box resources. |

513 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userRead/action | Allows a user to read their own Dev Box resources. |

514 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userWrite/action | Allows a user to create and update their own Dev Box resources. |

515 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userDelete/action | Allows a user to delete their own Dev Box resources. |

516 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userActionRead/action | Allows a user to read dev box actions. |

517 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userActionManage/action | Allows a user to skip or delay dev box actions. |

518 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userCustomize/action | Allows a user to customize their own Dev Box resources. |

519 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/adminRead/action | Allows a project administrator to read all of the environments in a project. |

520 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/userWrite/action | Allows a user to write the environments they have access to in a project. |

521 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/adminWrite/action | Allows a project administrator to write all of the environments in a project. |

522 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/userDelete/action | Allows a user to delete the environments they have access to in a project. |

523 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/adminDelete/action | Allows a project administrator to delete all of the environments in a project. |

524 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/adminAction/action | Allows a project administrator to perform an action on all of the environments in a project. |

525 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/adminActionRead/action | Allows an admin to read environment actions. |

526 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/adminActionManage/action | Allows an admin to skip, delay etc. environment actions. |

527 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/adminOutputsRead/action | Allows an admin to read Output values from environment deployment. |

528 −> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/pools/align/action | Allows a user to align all virtual machines in the pool. |

529 −> | **NotDataActions** | |

530 −> | *none* | |

531 −

532 −```json

533 −{

534 − "assignableScopes": [

535 − "/"

536 − ],

537 − "description": "Provides access to manage project resources.",

538 − "id": "/providers/Microsoft.Authorization/roleDefinitions/331c37c6-af14-46d9-b9f4-e1909e1b95a0",

539 − "name": "331c37c6-af14-46d9-b9f4-e1909e1b95a0",

540 − "permissions": [

541 − {

542 − "actions": [

543 − "Microsoft.DevCenter/projects/*",

544 − "Microsoft.Authorization/*/read",

545 − "Microsoft.Resources/deployments/*",

546 − "Microsoft.Resources/subscriptions/resourceGroups/read"

547 − ],

548 − "notActions": [

549 − "Microsoft.DevCenter/projects/write",

550 − "Microsoft.DevCenter/projects/delete"

551 − ],

552 − "dataActions": [

553 − "Microsoft.DevCenter/projects/users/devboxes/adminStart/action",

554 − "Microsoft.DevCenter/projects/users/devboxes/adminStop/action",

555 − "Microsoft.DevCenter/projects/users/devboxes/adminRead/action",

556 − "Microsoft.DevCenter/projects/users/devboxes/adminWrite/action",

557 − "Microsoft.DevCenter/projects/users/devboxes/adminDelete/action",

558 − "Microsoft.DevCenter/projects/users/devboxes/adminAlign/action",

559 − "Microsoft.DevCenter/projects/users/devboxes/adminActionRead/action",

560 − "Microsoft.DevCenter/projects/users/devboxes/adminActionManage/action",

561 − "Microsoft.DevCenter/projects/users/devboxes/userStop/action",

562 − "Microsoft.DevCenter/projects/users/devboxes/userStart/action",

563 − "Microsoft.DevCenter/projects/users/devboxes/userGetRemoteConnection/action",

564 − "Microsoft.DevCenter/projects/users/devboxes/userRead/action",

565 − "Microsoft.DevCenter/projects/users/devboxes/userWrite/action",

566 − "Microsoft.DevCenter/projects/users/devboxes/userDelete/action",

567 − "Microsoft.DevCenter/projects/users/devboxes/userActionRead/action",

568 − "Microsoft.DevCenter/projects/users/devboxes/userActionManage/action",

569 − "Microsoft.DevCenter/projects/users/devboxes/userCustomize/action",

570 − "Microsoft.DevCenter/projects/users/environments/adminRead/action",

571 − "Microsoft.DevCenter/projects/users/environments/userWrite/action",

572 − "Microsoft.DevCenter/projects/users/environments/adminWrite/action",

573 − "Microsoft.DevCenter/projects/users/environments/userDelete/action",

574 − "Microsoft.DevCenter/projects/users/environments/adminDelete/action",

575 − "Microsoft.DevCenter/projects/users/environments/adminAction/action",

576 − "Microsoft.DevCenter/projects/users/environments/adminActionRead/action",

577 − "Microsoft.DevCenter/projects/users/environments/adminActionManage/action",

578 − "Microsoft.DevCenter/projects/users/environments/adminOutputsRead/action",

579 − "Microsoft.DevCenter/projects/pools/align/action"

580 − ],

581 − "notDataActions": []

582 − }

583 − ],

584 − "roleName": "DevCenter Project Admin",

585 − "roleType": "BuiltInRole",

586 − "type": "Microsoft.Authorization/roleDefinitions"

587 −}

588 −```

589 −

590 −## DevOps Infrastructure Contributor

591 −

592 −Read, write, delete and perform actions on Managed DevOps Pools

593 −

594 −> [!div class="mx-tableFixed"]

595 −> | Actions | Description |

596 −> | --- | --- |

597 −> | [Microsoft.DevOpsInfrastructure](../permissions/devops.md#microsoftdevopsinfrastructure)/register/action | Register the subscription for Microsoft.DevOpsInfrastructure |

598 −> | [Microsoft.DevOpsInfrastructure](../permissions/devops.md#microsoftdevopsinfrastructure)/unregister/action | Unregister the subscription for Microsoft.DevOpsInfrastructure |

599 −> | [Microsoft.DevOpsInfrastructure](../permissions/devops.md#microsoftdevopsinfrastructure)/*/read | |

600 −> | [Microsoft.DevOpsInfrastructure](../permissions/devops.md#microsoftdevopsinfrastructure)/Locations/OperationStatuses/write | Write OperationStatuses |

601 −> | [Microsoft.DevOpsInfrastructure](../permissions/devops.md#microsoftdevopsinfrastructure)/pools/write | Update a Pool |

602 −> | [Microsoft.DevOpsInfrastructure](../permissions/devops.md#microsoftdevopsinfrastructure)/pools/delete | Delete a Pool |

603 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

604 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

605 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

606 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

607 −> | **NotActions** | |

608 −> | *none* | |

609 −> | **DataActions** | |

610 −> | *none* | |

611 −> | **NotDataActions** | |

612 −> | *none* | |

613 −

614 −```json

615 −{

616 − "assignableScopes": [

617 − "/"

618 − ],

619 − "description": "Read, write, delete and perform actions on Managed DevOps Pools",

620 − "id": "/providers/Microsoft.Authorization/roleDefinitions/76153a9e-0edb-49bc-8e01-93c47e6b5180",

621 − "name": "76153a9e-0edb-49bc-8e01-93c47e6b5180",

622 − "permissions": [

623 − {

624 − "actions": [

625 − "Microsoft.DevOpsInfrastructure/register/action",

626 − "Microsoft.DevOpsInfrastructure/unregister/action",

627 − "Microsoft.DevOpsInfrastructure/*/read",

628 − "Microsoft.DevOpsInfrastructure/Locations/OperationStatuses/write",

629 − "Microsoft.DevOpsInfrastructure/pools/write",

630 − "Microsoft.DevOpsInfrastructure/pools/delete",

631 − "Microsoft.Authorization/*/read",

632 − "Microsoft.Insights/alertRules/*",

633 − "Microsoft.Resources/deployments/*",

634 − "Microsoft.Resources/subscriptions/resourceGroups/read"

635 − ],

636 − "notActions": [],

637 − "dataActions": [],

638 − "notDataActions": []

639 − }

640 − ],

641 − "roleName": "DevOps Infrastructure Contributor",

642 − "roleType": "BuiltInRole",

643 − "type": "Microsoft.Authorization/roleDefinitions"

644 −}

645 −```

646 −

647 −## DevTest Labs User

648 −

649 −Lets you connect, start, restart, and shutdown your virtual machines in your Azure DevTest Labs.

650 −

651 −[Learn more](/azure/devtest-labs/devtest-lab-add-devtest-user)

652 −

653 −> [!div class="mx-tableFixed"]

654 −> | Actions | Description |

655 −> | --- | --- |

656 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

657 −> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/availabilitySets/read | Get the properties of an availability set |

658 −> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/*/read | Read the properties of a virtual machine (VM sizes, runtime status, VM extensions, etc.) |

659 −> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/deallocate/action | Powers off the virtual machine and releases the compute resources |

660 −> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/read | Get the properties of a virtual machine |

661 −> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/restart/action | Restarts the virtual machine |

662 −> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/start/action | Starts the virtual machine |

663 −> | [Microsoft.DevTestLab](../permissions/devops.md#microsoftdevtestlab)/*/read | Read the properties of a lab |

664 −> | [Microsoft.DevTestLab](../permissions/devops.md#microsoftdevtestlab)/labs/claimAnyVm/action | Claim a random claimable virtual machine in the lab. |

665 −> | [Microsoft.DevTestLab](../permissions/devops.md#microsoftdevtestlab)/labs/createEnvironment/action | Create virtual machines in a lab. |

666 −> | [Microsoft.DevTestLab](../permissions/devops.md#microsoftdevtestlab)/labs/ensureCurrentUserProfile/action | Ensure the current user has a valid profile in the lab. |

667 −> | [Microsoft.DevTestLab](../permissions/devops.md#microsoftdevtestlab)/labs/formulas/delete | Delete formulas. |

668 −> | [Microsoft.DevTestLab](../permissions/devops.md#microsoftdevtestlab)/labs/formulas/read | Read formulas. |

669 −> | [Microsoft.DevTestLab](../permissions/devops.md#microsoftdevtestlab)/labs/formulas/write | Add or modify formulas. |

670 −> | [Microsoft.DevTestLab](../permissions/devops.md#microsoftdevtestlab)/labs/policySets/evaluatePolicies/action | Evaluates lab policy. |

671 −> | [Microsoft.DevTestLab](../permissions/devops.md#microsoftdevtestlab)/labs/virtualMachines/claim/action | Take ownership of an existing virtual machine |

672 −> | [Microsoft.DevTestLab](../permissions/devops.md#microsoftdevtestlab)/labs/virtualmachines/listApplicableSchedules/action | Lists the applicable start/stop schedules, if any. |

673 −> | [Microsoft.DevTestLab](../permissions/devops.md#microsoftdevtestlab)/labs/virtualMachines/getRdpFileContents/action | Gets a string that represents the contents of the RDP file for the virtual machine |

674 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/loadBalancers/backendAddressPools/join/action | Joins a load balancer backend address pool. Not Alertable. |

675 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/loadBalancers/inboundNatRules/join/action | Joins a load balancer inbound nat rule. Not Alertable. |

676 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/*/read | Read the properties of a network interface (for example, all the load balancers that the network interface is a part of) |

677 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/join/action | Joins a Virtual Machine to a network interface. Not Alertable. |

678 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/read | Gets a network interface definition. |

679 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/write | Creates a network interface or updates an existing network interface. |

680 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/publicIPAddresses/*/read | Read the properties of a public IP address |

681 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/publicIPAddresses/join/action | Joins a public IP address. Not Alertable. |

682 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/publicIPAddresses/read | Gets a public IP address definition. |

683 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/join/action | Joins a virtual network. Not Alertable. |

684 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |

685 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/read | Gets or lists deployments. |

686 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

687 −> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/listKeys/action | Returns the access keys for the specified storage account. |

688 −> | **NotActions** | |

689 −> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/vmSizes/read | Lists available sizes the virtual machine can be updated to |

690 −> | **DataActions** | |

691 −> | *none* | |

692 −> | **NotDataActions** | |

693 −> | *none* | |

694 −

695 −```json

696 −{

697 − "assignableScopes": [

698 − "/"

699 − ],

700 − "description": "Lets you connect, start, restart, and shutdown your virtual machines in your Azure DevTest Labs.",

701 − "id": "/providers/Microsoft.Authorization/roleDefinitions/76283e04-6283-4c54-8f91-bcf1374a3c64",

702 − "name": "76283e04-6283-4c54-8f91-bcf1374a3c64",

703 − "permissions": [

704 − {

705 − "actions": [

706 − "Microsoft.Authorization/*/read",

707 − "Microsoft.Compute/availabilitySets/read",

708 − "Microsoft.Compute/virtualMachines/*/read",

709 − "Microsoft.Compute/virtualMachines/deallocate/action",

710 − "Microsoft.Compute/virtualMachines/read",

711 − "Microsoft.Compute/virtualMachines/restart/action",

712 − "Microsoft.Compute/virtualMachines/start/action",

713 − "Microsoft.DevTestLab/*/read",

714 − "Microsoft.DevTestLab/labs/claimAnyVm/action",

715 − "Microsoft.DevTestLab/labs/createEnvironment/action",

716 − "Microsoft.DevTestLab/labs/ensureCurrentUserProfile/action",

717 − "Microsoft.DevTestLab/labs/formulas/delete",

718 − "Microsoft.DevTestLab/labs/formulas/read",

719 − "Microsoft.DevTestLab/labs/formulas/write",

720 − "Microsoft.DevTestLab/labs/policySets/evaluatePolicies/action",

721 − "Microsoft.DevTestLab/labs/virtualMachines/claim/action",

722 − "Microsoft.DevTestLab/labs/virtualmachines/listApplicableSchedules/action",

723 − "Microsoft.DevTestLab/labs/virtualMachines/getRdpFileContents/action",

724 − "Microsoft.Network/loadBalancers/backendAddressPools/join/action",

725 − "Microsoft.Network/loadBalancers/inboundNatRules/join/action",

726 − "Microsoft.Network/networkInterfaces/*/read",

727 − "Microsoft.Network/networkInterfaces/join/action",

728 − "Microsoft.Network/networkInterfaces/read",

729 − "Microsoft.Network/networkInterfaces/write",

730 − "Microsoft.Network/publicIPAddresses/*/read",

731 − "Microsoft.Network/publicIPAddresses/join/action",

732 − "Microsoft.Network/publicIPAddresses/read",

733 − "Microsoft.Network/virtualNetworks/subnets/join/action",

734 − "Microsoft.Resources/deployments/operations/read",

735 − "Microsoft.Resources/deployments/read",

736 − "Microsoft.Resources/subscriptions/resourceGroups/read",

737 − "Microsoft.Storage/storageAccounts/listKeys/action"

738 − ],

739 − "notActions": [

740 − "Microsoft.Compute/virtualMachines/vmSizes/read"

741 − ],

742 − "dataActions": [],

743 − "notDataActions": []

744 − }

745 − ],

746 − "roleName": "DevTest Labs User",

747 − "roleType": "BuiltInRole",

748 − "type": "Microsoft.Authorization/roleDefinitions"

749 −}

750 −```

751 −

752 −## Lab Assistant

753 −

754 −Enables you to view an existing lab, perform actions on the lab VMs and send invitations to the lab.

755 −

756 −[Learn more](/azure/lab-services/administrator-guide)

757 −

758 −> [!div class="mx-tableFixed"]

759 −> | Actions | Description |

760 −> | --- | --- |

761 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

762 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

763 −> | [Microsoft.LabServices](../permissions/devops.md#microsoftlabservices)/labPlans/images/read | Get the properties of an image. |

764 −> | [Microsoft.LabServices](../permissions/devops.md#microsoftlabservices)/labPlans/read | Get the properties of a lab plan. |

765 −> | [Microsoft.LabServices](../permissions/devops.md#microsoftlabservices)/labs/read | Get the properties of a lab. |

766 −> | [Microsoft.LabServices](../permissions/devops.md#microsoftlabservices)/labs/schedules/read | Get the properties of a schedule. |

767 −> | [Microsoft.LabServices](../permissions/devops.md#microsoftlabservices)/labs/users/read | Get the properties of a user. |

768 −> | [Microsoft.LabServices](../permissions/devops.md#microsoftlabservices)/labs/users/invite/action | Send email invitation to a user to join the lab. |

769 −> | [Microsoft.LabServices](../permissions/devops.md#microsoftlabservices)/labs/virtualMachines/read | Get the properties of a virtual machine. |

770 −> | [Microsoft.LabServices](../permissions/devops.md#microsoftlabservices)/labs/virtualMachines/start/action | Start a virtual machine. |

771 −> | [Microsoft.LabServices](../permissions/devops.md#microsoftlabservices)/labs/virtualMachines/stop/action | Stop and deallocate a virtual machine. |

772 −> | [Microsoft.LabServices](../permissions/devops.md#microsoftlabservices)/labs/virtualMachines/reimage/action | Reimage a virtual machine to the last published image. |

773 −> | [Microsoft.LabServices](../permissions/devops.md#microsoftlabservices)/labs/virtualMachines/redeploy/action | Redeploy a virtual machine to a different compute node. |

774 −> | [Microsoft.LabServices](../permissions/devops.md#microsoftlabservices)/locations/usages/read | Get Usage in a location |

775 −> | [Microsoft.LabServices](../permissions/devops.md#microsoftlabservices)/skus/read | Get the properties of a Lab Services SKU. |

776 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

777 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

778 −> | **NotActions** | |

779 −> | *none* | |

780 −> | **DataActions** | |

781 −> | *none* | |

782 −> | **NotDataActions** | |

783 −> | *none* | |

784 −

785 −```json

786 −{

787 − "assignableScopes": [

788 − "/"

789 − ],

790 − "description": "The lab assistant role",

791 − "id": "/providers/Microsoft.Authorization/roleDefinitions/ce40b423-cede-4313-a93f-9b28290b72e1",

792 − "name": "ce40b423-cede-4313-a93f-9b28290b72e1",

793 − "permissions": [

794 − {

795 − "actions": [

796 − "Microsoft.Authorization/*/read",

797 − "Microsoft.Insights/alertRules/*",

798 − "Microsoft.LabServices/labPlans/images/read",

799 − "Microsoft.LabServices/labPlans/read",

800 − "Microsoft.LabServices/labs/read",

801 − "Microsoft.LabServices/labs/schedules/read",

802 − "Microsoft.LabServices/labs/users/read",

803 − "Microsoft.LabServices/labs/users/invite/action",

804 − "Microsoft.LabServices/labs/virtualMachines/read",

805 − "Microsoft.LabServices/labs/virtualMachines/start/action",

Azure built-in roles · devops

Microsoft's edit · 9 Apr 21:33 UTC