Azure built-in roles · devops
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/azure-docs · commit 906fd2a · +235 −9 lines · also on GitHub
⋯ 6 unchanged lines
77
author: rolyon
88
manager: pmwongera
99
ms.author: rolyon
10
−ms.date: 05/25/2025
10
+ms.date: 12/31/2025
1111
ms.custom: generated
1212
---
1313
⋯ 411 unchanged lines
425425
}
426426
```
427427
428
+## DevCenter Owner
429
+
430
+Provides access to manage all Microsoft.DevCenter resources, and to manage access to Microsoft.DevCenter resources by adding or removing role assignments for the DevCenter Project Admin and DevCenter Dev Box roles.
431
+
432
+[Learn more](/azure/dev-box/how-to-manage-dev-center)
433
+
434
+> [!div class="mx-tableFixed"]
435
+> | Actions | Description |
436
+> | --- | --- |
437
+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/* | |
438
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
439
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/write | Create a role assignment at the specified scope. |
440
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/delete | Delete a role assignment at the specified scope. |
441
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
442
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
443
+> | **NotActions** | |
444
+> | *none* | |
445
+> | **DataActions** | |
446
+> | *none* | |
447
+> | **NotDataActions** | |
448
+> | *none* | |
449
+> | **Condition** | |
450
+> | ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{331c37c6-af14-46d9-b9f4-e1909e1b95a0, 45d50f46-0b78-4001-a660-4198cbe8cd05})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{331c37c6-af14-46d9-b9f4-e1909e1b95a0, 45d50f46-0b78-4001-a660-4198cbe8cd05})) | |
451
+
452
+```json
453
+{
454
+ "assignableScopes": [
455
+ "/"
456
+ ],
457
+ "description": "Provides access to manage all Microsoft.DevCenter resources, and to manage access to Microsoft.DevCenter resources by adding or removing role assignments for the DevCenter Project Admin and DevCenter Dev Box roles.",
458
+ "id": "/providers/Microsoft.Authorization/roleDefinitions/4c6569b6-f23e-4295-9b90-bd4cc4ff3292",
459
+ "name": "4c6569b6-f23e-4295-9b90-bd4cc4ff3292",
460
+ "permissions": [
461
+ {
462
+ "actions": [
463
+ "Microsoft.DevCenter/*",
464
+ "Microsoft.Authorization/*/read",
465
+ "Microsoft.Authorization/roleAssignments/write",
466
+ "Microsoft.Authorization/roleAssignments/delete",
467
+ "Microsoft.Resources/deployments/*",
468
+ "Microsoft.Resources/subscriptions/resourceGroups/read"
469
+ ],
470
+ "notActions": [],
471
+ "dataActions": [],
472
+ "notDataActions": [],
473
+ "conditionVersion": "2.0",
474
+ "condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{331c37c6-af14-46d9-b9f4-e1909e1b95a0, 45d50f46-0b78-4001-a660-4198cbe8cd05})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{331c37c6-af14-46d9-b9f4-e1909e1b95a0, 45d50f46-0b78-4001-a660-4198cbe8cd05}))"
475
+ }
476
+ ],
477
+ "roleName": "DevCenter Owner",
478
+ "roleType": "BuiltInRole",
479
+ "type": "Microsoft.Authorization/roleDefinitions"
480
+}
481
+```
482
+
428483
## DevCenter Project Admin
429484
430485
Provides access to manage project resources.
⋯ 16 unchanged lines
447502
> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/adminRead/action | Allows a user read access to any Dev Box resource. |
448503
> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/adminWrite/action | Allows a user write access to any Dev Box resource. |
449504
> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/adminDelete/action | Allows a user to delete any Dev Box resource. |
505
+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/adminAlign/action | Allows an admin to align a Dev Box with the pool configuration. |
506
+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/adminActionRead/action | Allows an admin to read dev box actions. |
507
+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/adminActionManage/action | Allows an admin to skip or delay dev box actions. |
450508
> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userStop/action | Allows a user to stop their own Dev Box resources. |
451509
> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userStart/action | Allows a user to start their own Dev Box resources. |
452510
> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userGetRemoteConnection/action | Allows a user to get the RDP connection information for their own Dev Box resources. |
⋯ 12 unchanged lines
465523
> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/adminActionRead/action | Allows an admin to read environment actions. |
466524
> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/adminActionManage/action | Allows an admin to skip, delay etc. environment actions. |
467525
> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/adminOutputsRead/action | Allows an admin to read Output values from environment deployment. |
526
+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/pools/align/action | Allows a user to align all virtual machines in the pool. |
468527
> | **NotDataActions** | |
469528
> | *none* | |
470529
⋯ 23 unchanged lines
494553
"Microsoft.DevCenter/projects/users/devboxes/adminRead/action",
495554
"Microsoft.DevCenter/projects/users/devboxes/adminWrite/action",
496555
"Microsoft.DevCenter/projects/users/devboxes/adminDelete/action",
556
+ "Microsoft.DevCenter/projects/users/devboxes/adminAlign/action",
557
+ "Microsoft.DevCenter/projects/users/devboxes/adminActionRead/action",
558
+ "Microsoft.DevCenter/projects/users/devboxes/adminActionManage/action",
497559
"Microsoft.DevCenter/projects/users/devboxes/userStop/action",
498560
"Microsoft.DevCenter/projects/users/devboxes/userStart/action",
499561
"Microsoft.DevCenter/projects/users/devboxes/userGetRemoteConnection/action",
⋯ 11 unchanged lines
511573
"Microsoft.DevCenter/projects/users/environments/adminAction/action",
512574
"Microsoft.DevCenter/projects/users/environments/adminActionRead/action",
513575
"Microsoft.DevCenter/projects/users/environments/adminActionManage/action",
514
− "Microsoft.DevCenter/projects/users/environments/adminOutputsRead/action"
576
+ "Microsoft.DevCenter/projects/users/environments/adminOutputsRead/action",
577
+ "Microsoft.DevCenter/projects/pools/align/action"
515578
],
516579
"notDataActions": []
517580
}
⋯ 55 unchanged lines
573636
"notDataActions": []
574637
}
575638
],
576
− "roleName": "DevOps Infrastructure Contributor Role",
639
+ "roleName": "DevOps Infrastructure Contributor",
577640
"roleType": "BuiltInRole",
578641
"type": "Microsoft.Authorization/roleDefinitions"
579642
}
⋯ 549 unchanged lines
11291192
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
11301193
> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
11311194
> | **NotActions** | |
1132
−> | *none* | |
1195
+> | [Microsoft.LoadTestService](../permissions/devops.md#microsoftloadtestservice)/PlaywrightWorkspaces/* | |
1196
+> | [Microsoft.LoadTestService](../permissions/devops.md#microsoftloadtestservice)/locations/PlaywrightQuotas/* | |
11331197
> | **DataActions** | |
11341198
> | [Microsoft.LoadTestService](../permissions/devops.md#microsoftloadtestservice)/loadtests/* | Create and manage load tests |
11351199
> | [Microsoft.LoadTestService](../permissions/devops.md#microsoftloadtestservice)/testProfiles/* | |
⋯ 18 unchanged lines
11541218
"Microsoft.Resources/subscriptions/resourceGroups/read",
11551219
"Microsoft.Insights/alertRules/*"
11561220
],
1157
− "notActions": [],
1221
+ "notActions": [
1222
+ "Microsoft.LoadTestService/PlaywrightWorkspaces/*",
1223
+ "Microsoft.LoadTestService/locations/PlaywrightQuotas/*"
1224
+ ],
11581225
"dataActions": [
11591226
"Microsoft.LoadTestService/loadtests/*",
11601227
"Microsoft.LoadTestService/testProfiles/*",
⋯ 23 unchanged lines
11841251
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
11851252
> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
11861253
> | **NotActions** | |
1187
−> | *none* | |
1254
+> | [Microsoft.LoadTestService](../permissions/devops.md#microsoftloadtestservice)/PlaywrightWorkspaces/* | |
1255
+> | [Microsoft.LoadTestService](../permissions/devops.md#microsoftloadtestservice)/locations/PlaywrightQuotas/* | |
11881256
> | **DataActions** | |
11891257
> | [Microsoft.LoadTestService](../permissions/devops.md#microsoftloadtestservice)/* | Create and manage load testing resources |
11901258
> | **NotDataActions** | |
⋯ 16 unchanged lines
12071275
"Microsoft.Resources/subscriptions/resourceGroups/read",
12081276
"Microsoft.Insights/alertRules/*"
12091277
],
1210
− "notActions": [],
1278
+ "notActions": [
1279
+ "Microsoft.LoadTestService/PlaywrightWorkspaces/*",
1280
+ "Microsoft.LoadTestService/locations/PlaywrightQuotas/*"
1281
+ ],
12111282
"dataActions": [
12121283
"Microsoft.LoadTestService/*"
12131284
],
⋯ 21 unchanged lines
12351306
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
12361307
> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
12371308
> | **NotActions** | |
1238
−> | *none* | |
1309
+> | [Microsoft.LoadTestService](../permissions/devops.md#microsoftloadtestservice)/PlaywrightWorkspaces/* | |
1310
+> | [Microsoft.LoadTestService](../permissions/devops.md#microsoftloadtestservice)/locations/PlaywrightQuotas/* | |
12391311
> | **DataActions** | |
12401312
> | [Microsoft.LoadTestService](../permissions/devops.md#microsoftloadtestservice)/loadtests/readTest/action | Read Load Tests |
12411313
> | [Microsoft.LoadTestService](../permissions/devops.md#microsoftloadtestservice)/testProfiles/read | Read Test Profiles |
⋯ 18 unchanged lines
12601332
"Microsoft.Resources/subscriptions/resourceGroups/read",
12611333
"Microsoft.Insights/alertRules/*"
12621334
],
1263
− "notActions": [],
1335
+ "notActions": [
1336
+ "Microsoft.LoadTestService/PlaywrightWorkspaces/*",
1337
+ "Microsoft.LoadTestService/locations/PlaywrightQuotas/*"
1338
+ ],
12641339
"dataActions": [
12651340
"Microsoft.LoadTestService/loadtests/readTest/action",
12661341
"Microsoft.LoadTestService/testProfiles/read",
⋯ 3 unchanged lines
12701345
}
12711346
],
12721347
"roleName": "Load Test Reader",
1348
+ "roleType": "BuiltInRole",
1349
+ "type": "Microsoft.Authorization/roleDefinitions"
1350
+}
1351
+```
1352
+
1353
+## Playwright Workspace Contributor
1354
+
1355
+View and list Playwright Workspace resources but can not make any changes. Can manage service access tokens and execute Playwright tests.
1356
+
1357
+[Learn more](/azure/app-testing/playwright-workspaces/how-to-manage-workspace-access)
1358
+
1359
+> [!div class="mx-tableFixed"]
1360
+> | Actions | Description |
1361
+> | --- | --- |
1362
+> | [Microsoft.Loadtestservice](../permissions/devops.md#microsoftloadtestservice)/playwrightworkspaces/*/read | |
1363
+> | [Microsoft.Loadtestservice](../permissions/devops.md#microsoftloadtestservice)/locations/playwrightquotas/* | |
1364
+> | [Microsoft.Loadtestservice](../permissions/devops.md#microsoftloadtestservice)/playwrightworkspaces/AccessTokens/* | |
1365
+> | [Microsoft.Loadtestservice](../permissions/devops.md#microsoftloadtestservice)/playwrightworkspaces/TestRuns/* | |
1366
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
1367
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
1368
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
1369
+> | **NotActions** | |
1370
+> | *none* | |
1371
+> | **DataActions** | |
1372
+> | *none* | |
1373
+> | **NotDataActions** | |
1374
+> | *none* | |
1375
+
1376
+```json
1377
+{
1378
+ "assignableScopes": [
1379
+ "/"
1380
+ ],
1381
+ "description": "View and list Playwright Workspace resources but can not make any changes. Can manage service access tokens and execute Playwright tests.",
1382
+ "id": "/providers/Microsoft.Authorization/roleDefinitions/78cf819f-0969-4ebe-8759-015c6efcd5bf",
1383
+ "name": "78cf819f-0969-4ebe-8759-015c6efcd5bf",
1384
+ "permissions": [
1385
+ {
1386
+ "actions": [
1387
+ "Microsoft.Loadtestservice/playwrightworkspaces/*/read",
1388
+ "Microsoft.Loadtestservice/locations/playwrightquotas/*",
1389
+ "Microsoft.Loadtestservice/playwrightworkspaces/AccessTokens/*",
1390
+ "Microsoft.Loadtestservice/playwrightworkspaces/TestRuns/*",
1391
+ "Microsoft.Authorization/*/read",
1392
+ "Microsoft.Resources/deployments/*",
1393
+ "Microsoft.Resources/subscriptions/resourceGroups/read"
1394
+ ],
1395
+ "notActions": [],
1396
+ "dataActions": [],
1397
+ "notDataActions": []
1398
+ }
1399
+ ],
1400
+ "roleName": "Playwright Workspace Contributor",
1401
+ "roleType": "BuiltInRole",
1402
+ "type": "Microsoft.Authorization/roleDefinitions"
1403
+}
1404
+```
1405
+
1406
+## Playwright Workspace Owner
1407
+
1408
+Perform all operations on Playwright Workspace resources. Can manage service access tokens and execute Playwright tests.
1409
+
1410
+[Learn more](/azure/app-testing/playwright-workspaces/how-to-manage-workspace-access)
1411
+
1412
+> [!div class="mx-tableFixed"]
1413
+> | Actions | Description |
1414
+> | --- | --- |
1415
+> | [Microsoft.Loadtestservice](../permissions/devops.md#microsoftloadtestservice)/playwrightworkspaces/* | |
1416
+> | [Microsoft.Loadtestservice](../permissions/devops.md#microsoftloadtestservice)/locations/playwrightquotas/* | |
1417
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
1418
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
1419
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
1420
+> | **NotActions** | |
1421
+> | *none* | |
1422
+> | **DataActions** | |
1423
+> | *none* | |
1424
+> | **NotDataActions** | |
1425
+> | *none* | |
1426
+
1427
+```json
1428
+{
1429
+ "assignableScopes": [
1430
+ "/"
1431
+ ],
1432
+ "description": "Perform all operations on Playwright Workspace resources. Can manage service access tokens and execute Playwright tests.",
1433
+ "id": "/providers/Microsoft.Authorization/roleDefinitions/45265627-32f7-4da4-9ab0-b1cb0e9ec70b",
1434
+ "name": "45265627-32f7-4da4-9ab0-b1cb0e9ec70b",
1435
+ "permissions": [
1436
+ {
1437
+ "actions": [
1438
+ "Microsoft.Loadtestservice/playwrightworkspaces/*",
1439
+ "Microsoft.Loadtestservice/locations/playwrightquotas/*",
1440
+ "Microsoft.Authorization/*/read",
1441
+ "Microsoft.Resources/deployments/*",
1442
+ "Microsoft.Resources/subscriptions/resourceGroups/read"
1443
+ ],
1444
+ "notActions": [],
1445
+ "dataActions": [],
1446
+ "notDataActions": []
1447
+ }
1448
+ ],
1449
+ "roleName": "Playwright Workspace Owner",
1450
+ "roleType": "BuiltInRole",
1451
+ "type": "Microsoft.Authorization/roleDefinitions"
1452
+}
1453
+```
1454
+
1455
+## Playwright Workspace Reader
1456
+
1457
+View and list all Playwright Workspace resources and tests but can not make any changes.
1458
+
1459
+[Learn more](/azure/app-testing/playwright-workspaces/how-to-manage-workspace-access)
1460
+
1461
+> [!div class="mx-tableFixed"]
1462
+> | Actions | Description |
1463
+> | --- | --- |
1464
+> | [Microsoft.Loadtestservice](../permissions/devops.md#microsoftloadtestservice)/playwrightworkspaces/*/read | |
1465
+> | [Microsoft.Loadtestservice](../permissions/devops.md#microsoftloadtestservice)/locations/playwrightquotas/*/read | |
1466
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
1467
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
1468
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
1469
+> | **NotActions** | |
1470
+> | *none* | |
1471
+> | **DataActions** | |
1472
+> | *none* | |
1473
+> | **NotDataActions** | |
1474
+> | *none* | |
1475
+
1476
+```json
1477
+{
1478
+ "assignableScopes": [
1479
+ "/"
1480
+ ],
1481
+ "description": "View and list all Playwright Workspace resources and tests but can not make any changes.",
1482
+ "id": "/providers/Microsoft.Authorization/roleDefinitions/19d36063-d00b-4ea5-a1ac-a7c4926a0b78",
1483
+ "name": "19d36063-d00b-4ea5-a1ac-a7c4926a0b78",
1484
+ "permissions": [
1485
+ {
1486
+ "actions": [
1487
+ "Microsoft.Loadtestservice/playwrightworkspaces/*/read",
1488
+ "Microsoft.Loadtestservice/locations/playwrightquotas/*/read",
1489
+ "Microsoft.Authorization/*/read",
1490
+ "Microsoft.Resources/deployments/*",
1491
+ "Microsoft.Resources/subscriptions/resourceGroups/read"
1492
+ ],
1493
+ "notActions": [],
1494
+ "dataActions": [],
1495
+ "notDataActions": []
1496
+ }
1497
+ ],
1498
+ "roleName": "Playwright Workspace Reader",
12731499
"roleType": "BuiltInRole",
12741500
"type": "Microsoft.Authorization/roleDefinitions"
12751501
}
⋯ 5 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/azure-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 09:55 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.