Azure built-in roles · general
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/azure-docs · commit 579e71a · +0 −190 lines · also on GitHub
⋯ 15 unchanged lines
1616
This article lists the Azure built-in roles in the General category.
1717
1818
19
−## Contributor
20
−
21
−Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries.
22
−
23
−[Learn more](/azure/role-based-access-control/rbac-and-directory-admin-roles)
24
−
25
−> [!div class="mx-tableFixed"]
26
−> | Actions | Description |
27
−> | --- | --- |
28
−> | * | Create and manage resources of all types |
29
−> | **NotActions** | |
30
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/Delete | Delete roles, policy assignments, policy definitions and policy set definitions |
31
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/Write | Create roles, role assignments, policy assignments, policy definitions and policy set definitions |
32
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/elevateAccess/Action | Grants the caller User Access Administrator access at the tenant scope |
33
−> | [Microsoft.Blueprint](../permissions/management-and-governance.md#microsoftblueprint)/blueprintAssignments/write | Create or update any blueprint assignments |
34
−> | [Microsoft.Blueprint](../permissions/management-and-governance.md#microsoftblueprint)/blueprintAssignments/delete | Delete any blueprint assignments |
35
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/galleries/share/action | Shares a Gallery to different scopes |
36
−> | [Microsoft.Purview](../permissions/analytics.md#microsoftpurview)/consents/write | Create or Update a Consent Resource. |
37
−> | [Microsoft.Purview](../permissions/analytics.md#microsoftpurview)/consents/delete | Delete the Consent Resource. |
38
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deploymentStacks/manageDenySetting/action | Manage the denySettings property of a deployment stack. |
39
−> | **DataActions** | |
40
−> | *none* | |
41
−> | **NotDataActions** | |
42
−> | *none* | |
43
−
44
−```json
45
−{
46
− "assignableScopes": [
47
− "/"
48
− ],
49
− "description": "Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries.",
50
− "id": "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
51
− "name": "b24988ac-6180-42a0-ab88-20f7382dd24c",
52
− "permissions": [
53
− {
54
− "actions": [
55
− "*"
56
− ],
57
− "notActions": [
58
− "Microsoft.Authorization/*/Delete",
59
− "Microsoft.Authorization/*/Write",
60
− "Microsoft.Authorization/elevateAccess/Action",
61
− "Microsoft.Blueprint/blueprintAssignments/write",
62
− "Microsoft.Blueprint/blueprintAssignments/delete",
63
− "Microsoft.Compute/galleries/share/action",
64
− "Microsoft.Purview/consents/write",
65
− "Microsoft.Purview/consents/delete",
66
− "Microsoft.Resources/deploymentStacks/manageDenySetting/action"
67
− ],
68
− "dataActions": [],
69
− "notDataActions": []
70
− }
71
− ],
72
− "roleName": "Contributor",
73
− "roleType": "BuiltInRole",
74
− "type": "Microsoft.Authorization/roleDefinitions"
75
−}
76
−```
77
−
78
−## Owner
79
−
80
−Grants full access to manage all resources, including the ability to assign roles in Azure RBAC.
81
−
82
−[Learn more](/azure/role-based-access-control/rbac-and-directory-admin-roles)
83
−
84
−> [!div class="mx-tableFixed"]
85
−> | Actions | Description |
86
−> | --- | --- |
87
−> | * | Create and manage resources of all types |
88
−> | **NotActions** | |
89
−> | *none* | |
90
−> | **DataActions** | |
91
−> | *none* | |
92
−> | **NotDataActions** | |
93
−> | *none* | |
94
−
95
−```json
96
−{
97
− "assignableScopes": [
98
− "/"
99
− ],
100
− "description": "Grants full access to manage all resources, including the ability to assign roles in Azure RBAC.",
101
− "id": "/providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635",
102
− "name": "8e3af657-a8ff-443c-a75c-2fe8c4bcb635",
103
− "permissions": [
104
− {
105
− "actions": [
106
− "*"
107
− ],
108
− "notActions": [],
109
− "dataActions": [],
110
− "notDataActions": []
111
− }
112
− ],
113
− "roleName": "Owner",
114
− "roleType": "BuiltInRole",
115
− "type": "Microsoft.Authorization/roleDefinitions"
116
−}
117
−```
118
−
11919
## Reader
12020
12121
View all resources, but does not allow you to make any changes.
⋯ 30 unchanged lines
15252
}
15353
],
15454
"roleName": "Reader",
155
− "roleType": "BuiltInRole",
156
− "type": "Microsoft.Authorization/roleDefinitions"
157
−}
158
−```
159
−
160
−## Role Based Access Control Administrator
161
−
162
−Manage access to Azure resources by assigning roles using Azure RBAC. This role does not allow you to manage access using other ways, such as Azure Policy.
163
−
164
−> [!div class="mx-tableFixed"]
165
−> | Actions | Description |
166
−> | --- | --- |
167
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/write | Create a role assignment at the specified scope. |
168
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/delete | Delete a role assignment at the specified scope. |
169
−> | */read | Read resources of all types, except secrets. |
170
−> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
171
−> | **NotActions** | |
172
−> | *none* | |
173
−> | **DataActions** | |
174
−> | *none* | |
175
−> | **NotDataActions** | |
176
−> | *none* | |
177
−
178
−```json
179
−{
180
− "assignableScopes": [
181
− "/"
182
− ],
183
− "description": "Manage access to Azure resources by assigning roles using Azure RBAC. This role does not allow you to manage access using other ways, such as Azure Policy.",
184
− "id": "/providers/Microsoft.Authorization/roleDefinitions/f58310d9-a9f6-439a-9e8d-f62e7b41a168",
185
− "name": "f58310d9-a9f6-439a-9e8d-f62e7b41a168",
186
− "permissions": [
187
− {
188
− "actions": [
189
− "Microsoft.Authorization/roleAssignments/write",
190
− "Microsoft.Authorization/roleAssignments/delete",
191
− "*/read",
192
− "Microsoft.Support/*"
193
− ],
194
− "notActions": [],
195
− "dataActions": [],
196
− "notDataActions": []
197
− }
198
− ],
199
− "roleName": "Role Based Access Control Administrator",
200
− "roleType": "BuiltInRole",
201
− "type": "Microsoft.Authorization/roleDefinitions"
202
−}
203
−```
204
−
205
−## User Access Administrator
206
−
207
−Lets you manage user access to Azure resources.
208
−
209
−[Learn more](/azure/role-based-access-control/rbac-and-directory-admin-roles)
210
−
211
−> [!div class="mx-tableFixed"]
212
−> | Actions | Description |
213
−> | --- | --- |
214
−> | */read | Read resources of all types, except secrets. |
215
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/* | Manage authorization |
216
−> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
217
−> | **NotActions** | |
218
−> | *none* | |
219
−> | **DataActions** | |
220
−> | *none* | |
221
−> | **NotDataActions** | |
222
−> | *none* | |
223
−
224
−```json
225
−{
226
− "assignableScopes": [
227
− "/"
228
− ],
229
− "description": "Lets you manage user access to Azure resources.",
230
− "id": "/providers/Microsoft.Authorization/roleDefinitions/18d7d88d-d35e-4fb5-a5c3-7773c20a72d9",
231
− "name": "18d7d88d-d35e-4fb5-a5c3-7773c20a72d9",
232
− "permissions": [
233
− {
234
− "actions": [
235
− "*/read",
236
− "Microsoft.Authorization/*",
237
− "Microsoft.Support/*"
238
− ],
239
− "notActions": [],
240
− "dataActions": [],
241
− "notDataActions": []
242
− }
243
− ],
244
− "roleName": "User Access Administrator",
24555
"roleType": "BuiltInRole",
24656
"type": "Microsoft.Authorization/roleDefinitions"
24757
}
⋯ 5 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/azure-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 10:28 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.