Azure built-in roles · integration
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/azure-docs · commit 2a6e567 · +214 −1 lines · also on GitHub
⋯ 6 unchanged lines
77
author: jenniferf-skc
88
manager: pmwongera
99
ms.author: jfields
10
−ms.date: 05/25/2025
10
+ms.date: 08/26/2025
1111
ms.custom: generated
1212
---
1313
⋯ 961 unchanged lines
975975
}
976976
],
977977
"roleName": "Azure API Center Service Reader",
978
+ "roleType": "BuiltInRole",
979
+ "type": "Microsoft.Authorization/roleDefinitions"
980
+}
981
+```
982
+## Azure Batch Account Contributor
983
+
984
+Grants full access to manage all Batch resources, including Batch accounts, pools and jobs.
985
+
986
+[Learn more](/azure/batch/batch-role-based-access-control)
987
+
988
+> [!div class="mx-tableFixed"]
989
+> | Actions | Description |
990
+> | --- | --- |
991
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
992
+> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/* | |
993
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
994
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
995
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
996
+> | **NotActions** | |
997
+> | *none* | |
998
+> | **DataActions** | |
999
+> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/* | |
1000
+> | **NotDataActions** | |
1001
+> | *none* | |
1002
+
1003
+```json
1004
+{
1005
+ "assignableScopes": [
1006
+ "/"
1007
+ ],
1008
+ "description": "Grants full access to manage all Batch resources, including Batch accounts, pools and jobs.",
1009
+ "id": "/providers/Microsoft.Authorization/roleDefinitions/29fe4964-1e60-436b-bd3a-77fd4c178b3c",
1010
+ "name": "29fe4964-1e60-436b-bd3a-77fd4c178b3c",
1011
+ "permissions": [
1012
+ {
1013
+ "actions": [
1014
+ "Microsoft.Authorization/*/read",
1015
+ "Microsoft.Batch/*",
1016
+ "Microsoft.Insights/alertRules/*",
1017
+ "Microsoft.Resources/deployments/*",
1018
+ "Microsoft.Resources/subscriptions/resourceGroups/read"
1019
+ ],
1020
+ "notActions": [],
1021
+ "dataActions": [
1022
+ "Microsoft.Batch/*"
1023
+ ],
1024
+ "notDataActions": []
1025
+ }
1026
+ ],
1027
+ "roleName": "Azure Batch Account Contributor",
1028
+ "roleType": "BuiltInRole",
1029
+ "type": "Microsoft.Authorization/roleDefinitions"
1030
+}
1031
+```
1032
+
1033
+## Azure Batch Account Reader
1034
+
1035
+Lets you view all resources including pools and jobs in the Batch account.
1036
+
1037
+[Learn more](/azure/batch/batch-role-based-access-control)
1038
+
1039
+> [!div class="mx-tableFixed"]
1040
+> | Actions | Description |
1041
+> | --- | --- |
1042
+> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/*/read | |
1043
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
1044
+> | **NotActions** | |
1045
+> | *none* | |
1046
+> | **DataActions** | |
1047
+> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/*/read | |
1048
+> | **NotDataActions** | |
1049
+> | *none* | |
1050
+
1051
+```json
1052
+{
1053
+ "assignableScopes": [
1054
+ "/"
1055
+ ],
1056
+ "description": "Lets you view all resources including pools and jobs in the Batch account.",
1057
+ "id": "/providers/Microsoft.Authorization/roleDefinitions/11076f67-66f6-4be0-8f6b-f0609fd05cc9",
1058
+ "name": "11076f67-66f6-4be0-8f6b-f0609fd05cc9",
1059
+ "permissions": [
1060
+ {
1061
+ "actions": [
1062
+ "Microsoft.Batch/*/read",
1063
+ "Microsoft.Resources/subscriptions/resourceGroups/read"
1064
+ ],
1065
+ "notActions": [],
1066
+ "dataActions": [
1067
+ "Microsoft.Batch/*/read"
1068
+ ],
1069
+ "notDataActions": []
1070
+ }
1071
+ ],
1072
+ "roleName": "Azure Batch Account Reader",
1073
+ "roleType": "BuiltInRole",
1074
+ "type": "Microsoft.Authorization/roleDefinitions"
1075
+}
1076
+```
1077
+
1078
+## Azure Batch Data Contributor
1079
+
1080
+Grants permissions to manage Batch pools and jobs but not to modify accounts.
1081
+
1082
+[Learn more](/azure/batch/batch-role-based-access-control)
1083
+
1084
+> [!div class="mx-tableFixed"]
1085
+> | Actions | Description |
1086
+> | --- | --- |
1087
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
1088
+> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/read | Lists Batch accounts or gets the properties of a Batch account |
1089
+> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/applications/* | |
1090
+> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/certificates/* | |
1091
+> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/certificateOperationResults/* | |
1092
+> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/pools/* | |
1093
+> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/poolOperationResults/* | |
1094
+> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/locations/*/read | |
1095
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
1096
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
1097
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
1098
+> | **NotActions** | |
1099
+> | *none* | |
1100
+> | **DataActions** | |
1101
+> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/jobSchedules/* | |
1102
+> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/jobs/* | |
1103
+> | **NotDataActions** | |
1104
+> | *none* | |
1105
+
1106
+```json
1107
+{
1108
+ "assignableScopes": [
1109
+ "/"
1110
+ ],
1111
+ "description": "Grants permissions to manage Batch pools and jobs but not to modify accounts.",
1112
+ "id": "/providers/Microsoft.Authorization/roleDefinitions/6aaa78f1-f7de-44ca-8722-c64a23943cae",
1113
+ "name": "6aaa78f1-f7de-44ca-8722-c64a23943cae",
1114
+ "permissions": [
1115
+ {
1116
+ "actions": [
1117
+ "Microsoft.Authorization/*/read",
1118
+ "Microsoft.Batch/batchAccounts/read",
1119
+ "Microsoft.Batch/batchAccounts/applications/*",
1120
+ "Microsoft.Batch/batchAccounts/certificates/*",
1121
+ "Microsoft.Batch/batchAccounts/certificateOperationResults/*",
1122
+ "Microsoft.Batch/batchAccounts/pools/*",
1123
+ "Microsoft.Batch/batchAccounts/poolOperationResults/*",
1124
+ "Microsoft.Batch/locations/*/read",
1125
+ "Microsoft.Insights/alertRules/*",
1126
+ "Microsoft.Resources/deployments/*",
1127
+ "Microsoft.Resources/subscriptions/resourceGroups/read"
1128
+ ],
1129
+ "notActions": [],
1130
+ "dataActions": [
1131
+ "Microsoft.Batch/batchAccounts/jobSchedules/*",
1132
+ "Microsoft.Batch/batchAccounts/jobs/*"
1133
+ ],
1134
+ "notDataActions": []
1135
+ }
1136
+ ],
1137
+ "roleName": "Azure Batch Data Contributor",
1138
+ "roleType": "BuiltInRole",
1139
+ "type": "Microsoft.Authorization/roleDefinitions"
1140
+}
1141
+```
1142
+
1143
+## Azure Batch Job Submitter
1144
+
1145
+Lets you submit and manage jobs in the Batch account.
1146
+
1147
+[Learn more](/azure/batch/batch-role-based-access-control)
1148
+
1149
+> [!div class="mx-tableFixed"]
1150
+> | Actions | Description |
1151
+> | --- | --- |
1152
+> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/applications/read | Lists applications or gets the properties of an application |
1153
+> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/applications/versions/read | Gets the properties of an application package |
1154
+> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/pools/read | Lists pools on a Batch account or gets the properties of a pool |
1155
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
1156
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
1157
+> | **NotActions** | |
1158
+> | *none* | |
1159
+> | **DataActions** | |
1160
+> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/jobSchedules/* | |
1161
+> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/jobs/* | |
1162
+> | **NotDataActions** | |
1163
+> | *none* | |
1164
+
1165
+```json
1166
+{
1167
+ "assignableScopes": [
1168
+ "/"
1169
+ ],
1170
+ "description": "Lets you submit and manage jobs in the Batch account.",
1171
+ "id": "/providers/Microsoft.Authorization/roleDefinitions/48e5e92e-a480-4e71-aa9c-2778f4c13781",
1172
+ "name": "48e5e92e-a480-4e71-aa9c-2778f4c13781",
1173
+ "permissions": [
1174
+ {
1175
+ "actions": [
1176
+ "Microsoft.Batch/batchAccounts/applications/read",
1177
+ "Microsoft.Batch/batchAccounts/applications/versions/read",
1178
+ "Microsoft.Batch/batchAccounts/pools/read",
1179
+ "Microsoft.Insights/alertRules/*",
1180
+ "Microsoft.Resources/subscriptions/resourceGroups/read"
1181
+ ],
1182
+ "notActions": [],
1183
+ "dataActions": [
1184
+ "Microsoft.Batch/batchAccounts/jobSchedules/*",
1185
+ "Microsoft.Batch/batchAccounts/jobs/*"
1186
+ ],
1187
+ "notDataActions": []
1188
+ }
1189
+ ],
1190
+ "roleName": "Azure Batch Job Submitter",
9781191
"roleType": "BuiltInRole",
9791192
"type": "Microsoft.Authorization/roleDefinitions"
9801193
}
⋯ 2106 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/azure-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 08:30 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.