← cd ~/compare
// compare · azure roles
Contributor vs Reader
Two Azure built-in roles that are often confused, compared permission by permission.
In short: Contributor has 1 actions, 11 NotActions. Reader has 1 actions. Assign the one with less access that still covers the job.
| Contributor | Reader | |
|---|---|---|
| What Microsoft says | Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries. | View all resources, but does not allow you to make any changes. |
| Size | 1 actions, 11 NotActions | 1 actions |
Permissions only Contributor lists (1)
*
Permissions only Reader lists (1)
*/read
Azure roles use wildcards such as *, and NotActions take permissions away, so a role can cover an action without listing it. Check the role pages for the full picture.