Roles and permissions

Explore Microsoft's documented roles and permissions, and follow changes to each public reference.

Source and coverage

Documented built-in role definitions, literal permission blocks and assignable scopes. NotActions and NotDataActions are exclusions within a block, not global denies. Wildcard expansion, assignments, conditions and effective access require separate evaluation.

19 of 19 reference pages have a baseline · 0 failed their last read. A failed or unparsed page cannot establish that a role or permission disappeared.

These public references do not establish tenant assignments or effective access. Reference labels and anchors do not establish stable vendor template IDs or confirmed renames.

Observed changes and exact document comparisons

Saved searches 0

Keep up to eight named searches. Saved in this browser. Filters are also shareable in the page address.

5 matching entries · captured 23 Oct 2026, 08:30 UTC

Article history

Role or permission	Reference type	Documented terms
Contributor`b24988ac-6180-42a0-ab88-20f7382dd24c`	Built-in role	13 documented terms Block 1 · actions `` Block 1 · notActions `Microsoft.Authorization//Delete` `Microsoft.Authorization/*/Write` `Microsoft.Authorization/elevateAccess/Action` `Microsoft.Blueprint/blueprintAssignments/write` `Microsoft.Blueprint/blueprintAssignments/delete` `Microsoft.Compute/galleries/share/action` `Microsoft.Purview/consents/write` `Microsoft.Purview/consents/delete` `Microsoft.Resources/deploymentStacks/manageDenySetting/action` `Microsoft.Subscription/cancel/action` `Microsoft.Subscription/enable/action` Assignable scope (not an assignment) `/`
Owner`8e3af657-a8ff-443c-a75c-2fe8c4bcb635`	Built-in role	2 documented terms Block 1 · actions `*` Assignable scope (not an assignment) `/`
Reservations Administrator`a8889054-8d42-49c9-bc1c-52486c10e7cd`	Built-in role	8 documented terms Block 1 · actions `Microsoft.Capacity//read` `Microsoft.Capacity//action` `Microsoft.Capacity/*/write` `Microsoft.Authorization/roleAssignments/read` `Microsoft.Authorization/roleDefinitions/read` `Microsoft.Authorization/roleAssignments/write` `Microsoft.Authorization/roleAssignments/delete` Assignable scope (not an assignment) `/providers/Microsoft.Capacity`
Role Based Access Control Administrator`f58310d9-a9f6-439a-9e8d-f62e7b41a168`	Built-in role	5 documented terms Block 1 · actions `Microsoft.Authorization/roleAssignments/write` `Microsoft.Authorization/roleAssignments/delete` `/read` `Microsoft.Support/` Assignable scope (not an assignment) `/`
User Access Administrator`18d7d88d-d35e-4fb5-a5c3-7773c20a72d9`	Built-in role	4 documented terms Block 1 · actions `/read` `Microsoft.Authorization/` `Microsoft.Support/*` Assignable scope (not an assignment) `/`

Roles and permissions

Azure RBAC

Block 1 · actions

Block 1 · notActions

Assignable scope (not an assignment)

Block 1 · actions

Assignable scope (not an assignment)

Block 1 · actions

Assignable scope (not an assignment)

Block 1 · actions

Assignable scope (not an assignment)

Block 1 · actions

Assignable scope (not an assignment)