← cd ~/tools
// roles
Built-in roles explained
Every Azure and Microsoft Entra built-in role, with what it can do and how to assign it. Not sure which one you need? The least-privilege role finder picks the smallest for you.
Microsoft Entra roles (136)
Privileged
- Agent ID Administrator
- AI Administrator
- AI Reader
- Application Administrator
- Application Developer
- Attribute Provisioning Administrator
- Attribute Provisioning Reader
- Authentication Administrator
- Authentication Extensibility Administrator
- Authentication Extensibility Password Administrator
- B2C IEF Keyset Administrator
- Cloud Application Administrator
- Cloud Device Administrator
- Conditional Access Administrator
- Directory Writers
- Domain Name Administrator
- Entra SOC Identity Responder
- External Identity Provider Administrator
- Global Administrator
- Global Reader
- Helpdesk Administrator
- Hybrid Identity Administrator
- Identity Governance Administrator
- Intune Administrator
- Lifecycle Workflows Administrator
- Partner Tier1 Support
- Partner Tier2 Support
- Password Administrator
- Privileged Authentication Administrator
- Privileged Role Administrator
- Security Administrator
- Security Operator
- Security Reader
- Tenant Governance Administrator
- User Administrator
Other
- Agent ID Developer
- Agent Registry Administrator
- Attack Payload Author
- Attack Simulation Administrator
- Attribute Assignment Administrator
- Attribute Assignment Reader
- Attribute Definition Administrator
- Attribute Definition Reader
- Attribute Log Administrator
- Attribute Log Reader
- Authentication Policy Administrator
- Azure DevOps Administrator
- Azure Information Protection Administrator
- B2C IEF Policy Administrator
- Billing Administrator
- Cloud App Security Administrator
- Compliance Administrator
- Compliance Data Administrator
- Customer Delegated Admin Relationship Administrator
- Customer Lockbox Access Approver
- Desktop Analytics Administrator
- Directory Readers
- Directory Synchronization Accounts
- Dragon Administrator
- Dynamics 365 Administrator
- Dynamics 365 Business Central Administrator
- Edge Administrator
- Entra Backup Administrator
- Entra Backup Reader
- Exchange Administrator
- Exchange Backup Administrator
- Exchange Recipient Administrator
- Extended Directory User Administrator
- External ID User Flow Administrator
- External ID User Flow Attribute Administrator
- Fabric Administrator
- Global Secure Access Administrator
- Global Secure Access Log Reader
- Groups Administrator
- Guest Inviter
- Insights Administrator
- Insights Analyst
- Insights Business Leader
- IoT Device Administrator
- Kaizala Administrator
- Knowledge Administrator
- Knowledge Manager
- License Administrator
- Message Center Privacy Reader
- Message Center Reader
- Microsoft 365 Backup Administrator
- Microsoft 365 Migration Administrator
- Microsoft Entra Joined Device Local Administrator
- Microsoft Graph Data Connect Administrator
- Microsoft Hardware Warranty Administrator
- Microsoft Hardware Warranty Specialist
- Network Administrator
- Office Apps Administrator
- Organizational Branding Administrator
- Organizational Data Source Administrator
- Organizational Messages Approver
- Organizational Messages Writer
- People Administrator
- Permissions Management Administrator
- Places Administrator
- Power Platform Administrator
- Printer Administrator
- Printer Technician
- Purview Workload Content Administrator
- Purview Workload Content Reader
- Purview Workload Content Writer
- Reports Reader
- Search Administrator
- Search Editor
- Service Support Administrator
- SharePoint Administrator
- SharePoint Advanced Management Administrator
- SharePoint Backup Administrator
- SharePoint Embedded Administrator
- Skype for Business Administrator
- Teams Administrator
- Teams Communications Administrator
- Teams Communications Support Engineer
- Teams Communications Support Specialist
- Teams Devices Administrator
- Teams External Collaboration Administrator
- Teams Reader
- Teams Telephony Administrator
- Tenant Creator
- Tenant Governance Reader
- Tenant Governance Relationship Administrator
- Tenant Governance Relationship Reader
- Usage Summary Reports Reader
- User Experience Success Manager
- Virtual Visits Administrator
- Viva Glint Tenant Administrator
- Viva Goals Administrator
- Viva Pulse Administrator
- Windows 365 Administrator
- Windows Update Deployment Administrator
- Yammer Administrator
Azure roles (504)
Ai-machine-learning
- Azure AI Administrator
- Azure AI Developer
- Azure AI Enterprise Network Connection Approver
- Azure AI Inference Deployment Operator
- AzureML Compute Operator
- AzureML Data Scientist
- AzureML Metrics Writer (preview)
- AzureML Registry User
- Cognitive Services Contributor
- Cognitive Services Custom Vision Contributor
- Cognitive Services Custom Vision Deployment
- Cognitive Services Custom Vision Labeler
- Cognitive Services Custom Vision Reader
- Cognitive Services Custom Vision Trainer
- Cognitive Services Data Reader
- Cognitive Services Face Recognizer
- Cognitive Services Immersive Reader User
- Cognitive Services Language Owner
- Cognitive Services Language Reader
- Cognitive Services Language Writer
- Cognitive Services LUIS Owner
- Cognitive Services LUIS Reader
- Cognitive Services LUIS Writer
- Cognitive Services Metrics Advisor Administrator
- Cognitive Services Metrics Advisor User
- Cognitive Services OpenAI Contributor
- Cognitive Services OpenAI User
- Cognitive Services QnA Maker Editor
- Cognitive Services QnA Maker Reader
- Cognitive Services Speech Contributor
- Cognitive Services Speech User
- Cognitive Services Usages Reader
- Cognitive Services User
- Foundry Account Owner
- Foundry Owner
- Foundry Project Manager
- Foundry User
- Healthcare Agent Admin
- Healthcare Agent Editor
- Healthcare Agent Reader
- Search Index Data Contributor
- Search Index Data Reader
- Search Service Contributor
Analytics
- Azure Event Hubs Data Owner
- Azure Event Hubs Data Receiver
- Azure Event Hubs Data Sender
- Data Factory Contributor
- HDInsight Cluster Operator
- HDInsight Domain Services Contributor
- HDInsight on AKS Cluster Admin
- HDInsight on AKS Cluster Pool Admin
- Schema Registry Contributor
- Schema Registry Reader
- Stream Analytics Query Tester
Compute
- Azure Arc VMware VM Contributor
- Azure Batch Account Contributor
- Azure Batch Account Reader
- Azure Batch Data Contributor
- Azure Batch Job Submitter
- Classic Virtual Machine Contributor
- Compute Fleet Contributor
- Compute Gallery Artifacts Publisher
- Compute Gallery Image Reader
- Compute Gallery Sharing Admin
- Compute Limit Operator
- Data Operator for Managed Disks
- Desktop Virtualization Application Group Contributor
- Desktop Virtualization Application Group Reader
- Desktop Virtualization Contributor
- Desktop Virtualization Host Pool Contributor
- Desktop Virtualization Host Pool Reader
- Desktop Virtualization Power On Contributor
- Desktop Virtualization Power On Off Contributor
- Desktop Virtualization Reader
- Desktop Virtualization Session Host Operator
- Desktop Virtualization User
- Desktop Virtualization User Session Operator
- Desktop Virtualization Virtual Machine Contributor
- Desktop Virtualization Workspace Contributor
- Desktop Virtualization Workspace Reader
- Disk Backup Reader
- Disk Pool Operator
- Disk Restore Operator
- Disk Snapshot Contributor
- Quantum Workspace Data Contributor
- Virtual Machine Administrator Login
- Virtual Machine Contributor
- Virtual Machine Data Access Administrator (preview)
- Virtual Machine Local User Login
- Virtual Machine User Login
- VM Restore Operator
- Windows 365 Network Interface Contributor
- Windows 365 Network User
- Windows Admin Center Administrator Login
Containers
- AcrDelete
- AcrImageSigner
- AcrPull
- AcrPush
- AcrQuarantineReader
- AcrQuarantineWriter
- Azure Arc Enabled Kubernetes Cluster User Role
- Azure Arc Kubernetes Admin
- Azure Arc Kubernetes Cluster Admin
- Azure Arc Kubernetes Viewer
- Azure Arc Kubernetes Writer
- Azure Container Instances Contributor Role
- Azure Container Storage Contributor
- Azure Container Storage Operator
- Azure Container Storage Owner
- Azure Kubernetes Fleet Manager Contributor Role
- Azure Kubernetes Fleet Manager Hub Agent Role
- Azure Kubernetes Fleet Manager Hub Cluster User Role
- Azure Kubernetes Fleet Manager RBAC Admin
- Azure Kubernetes Fleet Manager RBAC Admin for Member Clusters
- Azure Kubernetes Fleet Manager RBAC Cluster Admin
- Azure Kubernetes Fleet Manager RBAC Cluster Admin for Member Clusters
- Azure Kubernetes Fleet Manager RBAC Reader
- Azure Kubernetes Fleet Manager RBAC Reader for Member Clusters
- Azure Kubernetes Fleet Manager RBAC Writer
- Azure Kubernetes Fleet Manager RBAC Writer for Member Clusters
- Azure Kubernetes Service Arc Cluster Admin Role
- Azure Kubernetes Service Arc Cluster User Role
- Azure Kubernetes Service Arc Contributor Role
- Azure Kubernetes Service Cluster Admin Role
- Azure Kubernetes Service Cluster Monitoring User
- Azure Kubernetes Service Cluster User Role
- Azure Kubernetes Service Contributor Role
- Azure Kubernetes Service Namespace Contributor
- Azure Kubernetes Service Namespace User
- Azure Kubernetes Service RBAC Admin
- Azure Kubernetes Service RBAC Cluster Admin
- Azure Kubernetes Service RBAC Reader
- Azure Kubernetes Service RBAC Writer
- Azure Red Hat OpenShift Cloud Controller Manager
- Azure Red Hat OpenShift Cluster Ingress Operator
- Azure Red Hat OpenShift Disk Storage Operator
- Azure Red Hat OpenShift Federated Credential
- Azure Red Hat OpenShift File Storage Operator
- Azure Red Hat OpenShift Image Registry Operator
- Azure Red Hat OpenShift Machine API Operator
- Azure Red Hat OpenShift Network Operator
- Azure Red Hat OpenShift Service Operator
- Connected Cluster Managed Identity CheckAccess Reader
- Container Apps ConnectedEnvironments Contributor
- Container Apps ConnectedEnvironments Reader
- Container Apps Contributor
- Container Apps Jobs Contributor
- Container Apps Jobs Operator
- Container Apps Jobs Reader
- Container Apps ManagedEnvironments Contributor
- Container Apps ManagedEnvironments Reader
- Container Apps Operator
- Container Apps SessionPools Contributor
- Container Apps SessionPools Reader
- Container Registry Cache Rule Administrator
- Container Registry Cache Rule Reader
- Container Registry Configuration Reader and Data Access Configuration Reader
- Container Registry Contributor and Data Access Configuration Administrator
- Container Registry Credential Set Administrator
- Container Registry Credential Set Reader
- Container Registry Data Importer and Data Reader
- Container Registry Repository Catalog Lister
- Container Registry Repository Contributor
- Container Registry Repository Reader
- Container Registry Repository Writer
- Container Registry Tasks Contributor
- Container Registry Transfer Pipeline Contributor
- Defender Kubernetes API Access
- Kubernetes Cluster - Azure Arc Onboarding
- Kubernetes Extension Contributor
- Service Fabric Cluster Contributor
- Service Fabric Managed Cluster Contributor
Databases
- Azure Connected SQL Server Onboarding
- Azure Managed Redis Contributor
- Azure Managed Redis Reader
- Cosmos DB Account Reader Role
- Cosmos DB Operator
- CosmosBackupOperator
- CosmosRestoreOperator
- DocumentDB Account Contributor
- PostgreSQL Flexible Server Long Term Retention Backup Role
- Redis Cache Contributor
- Semantic Reranker User
- SQL DB Contributor
- SQL Managed Instance Contributor
- SQL Security Manager
- SQL Server Contributor
Devops
- Chaos Studio Experiment Contributor
- Chaos Studio Operator
- Chaos Studio Reader
- Chaos Studio Target Contributor
- Deployment Environments Reader
- Deployment Environments User
- DevCenter Dev Box User
- DevCenter Owner
- DevCenter Project Admin
- DevOps Infrastructure Contributor
- DevTest Labs User
- Lab Assistant
- Lab Contributor
- Lab Creator
- Lab Operator
- Lab Services Contributor
- Lab Services Reader
- Load Test Contributor
- Load Test Owner
- Load Test Reader
- Playwright Workspace Contributor
- Playwright Workspace Owner
- Playwright Workspace Reader
General
Hybrid-multicloud
- Arc Gateway Manager
- Azure Arc ScVmm Administrator role
- Azure Arc ScVmm Private Cloud User
- Azure Arc ScVmm Private Clouds Onboarding
- Azure Arc ScVmm VM Contributor
- Azure Resource Bridge Deployment Role
- Azure Stack HCI Administrator
- Azure Stack HCI Connected InfraVMs
- Azure Stack HCI Device Management Role
- Azure Stack HCI VM Contributor
- Azure Stack HCI VM Reader
- Azure Stack Registration Owner
- Hybrid Server Resource Administrator
Identity
- Domain Services Contributor
- Domain Services Reader
- Managed Identity Contributor
- Managed Identity Operator
Integration
- API Management Developer Portal Content Editor
- API Management Service Contributor
- API Management Service Operator Role
- API Management Service Reader Role
- API Management Service Workspace API Developer
- API Management Service Workspace API Product Manager
- API Management Workspace API Developer
- API Management Workspace API Product Manager
- API Management Workspace Contributor
- API Management Workspace Reader
- App Configuration Contributor
- App Configuration Data Owner
- App Configuration Data Reader
- App Configuration Reader
- Azure API Center Compliance Manager
- Azure API Center Data Reader
- Azure API Center Service Contributor
- Azure API Center Service Reader
- Azure Relay Listener
- Azure Relay Owner
- Azure Relay Sender
- Azure Resource Notifications System Topics Subscriber
- Azure Service Bus Data Owner
- Azure Service Bus Data Receiver
- Azure Service Bus Data Sender
- BizTalk Contributor
- DeID Batch Data Owner
- DeID Batch Data Reader
- DeID Data Owner
- DeID Realtime Data User
- DICOM Data Owner
- DICOM Data Reader
- Durable Task Data Contributor
- Durable Task Data Reader
- Durable Task Worker
- EventGrid Contributor
- EventGrid Data Sender
- EventGrid EventSubscription Contributor
- EventGrid EventSubscription Reader
- EventGrid TopicSpaces Publisher
- EventGrid TopicSpaces Subscriber
- FHIR Data Bulk Operator
- FHIR Data Contributor
- FHIR Data Converter
- FHIR Data Exporter
- FHIR Data Importer
- FHIR Data Reader
- FHIR Data Writer
- FHIR SMART User
- Integration Service Environment Contributor
- Integration Service Environment Developer
- Intelligent Systems Account Contributor
- Logic App Contributor
- Logic App Operator
- Logic Apps Standard Contributor
- Logic Apps Standard Developer
- Logic Apps Standard Operator
- Logic Apps Standard Reader
- Scheduler Job Collections Contributor
- Services Hub Operator
Internet-of-things
- Azure Device Registry Administrator
- Azure Device Registry Contributor
- Azure Device Registry Credentials Contributor
- Azure Device Registry Onboarding
- Azure Digital Twins Data Owner
- Azure Digital Twins Data Reader
- Azure IoT Operations Administrator
- Azure IoT Operations Onboarding
- Device Provisioning Service Data Contributor
- Device Provisioning Service Data Reader
- Device Update Administrator
- Device Update Content Administrator
- Device Update Content Reader
- Device Update Deployments Administrator
- Device Update Deployments Reader
- Device Update Reader
- Firmware Analysis Admin
- Firmware Analysis Reader
- Firmware Analysis User
- IoT Hub Data Contributor
- IoT Hub Data Reader
- IoT Hub Registry Contributor
- IoT Hub Twin Contributor
Management-and-governance
- Advisor Recommendations Contributor (Assessments and Reviews)
- Advisor Reviews Contributor
- Advisor Reviews Reader
- Automation Contributor
- Automation Job Operator
- Automation Operator
- Automation Runbook Operator
- Azure Center for SAP solutions administrator
- Azure Center for SAP solutions reader
- Azure Center for SAP solutions service role
- Azure Connected Machine Onboarding
- Azure Connected Machine Resource Administrator
- Azure Connected Machine Resource Manager
- Azure Customer Lockbox Approver for Subscription
- Billing Reader
- Blueprint Contributor
- Blueprint Operator
- Carbon Optimization Reader
- Cost Management Contributor
- Cost Management Reader
- Essential Machine Management Administrator
- Hierarchy Settings Administrator
- Managed Application Contributor Role
- Managed Application Operator Role
- Managed Application Publisher Operator
- Managed Services Registration assignment Delete Role
- Management Group Contributor
- Management Group Reader
- New Relic APM Account Contributor
- Policy Insights Data Writer (Preview)
- Quota Request Operator
- Reservation Purchaser
- Reservations Reader
- Resource Policy Contributor
- Savings plan Purchaser
- Scheduled Patching Contributor
- Service Group Administrator
- Service Group Contributor
- Service Group Reader
- Site Recovery Contributor
- Site Recovery Operator
- Site Recovery Reader
- SRE Agent Administrator
- SRE Agent Reader
- SRE Agent Standard User
- Support Request Contributor
- Tag Contributor
- Template Spec Contributor
- Template Spec Reader
Migration
- Azure Local Migrate Execute Expert
- Azure Local Migrate Owner
- Azure Migrate Decide and Plan Expert
- Azure Migrate Execute Expert
- Azure Migrate Owner
- Azure Migrate Service Reader
- Migrate Arc Discovery Reader - Preview
Monitor
- Application Insights Component Contributor
- Application Insights Snapshot Debugger
- Azure Managed Grafana Workspace Contributor
- Data Purger
- Grafana Admin
- Grafana Editor
- Grafana Limited Viewer
- Grafana Viewer
- Log Analytics Contributor
- Log Analytics Data Reader
- Log Analytics Reader
- Monitoring Contributor
- Monitoring Metrics Publisher
- Monitoring Policy Contributor
- Monitoring Reader
- Service Health Security Reader
- Workbook Contributor
- Workbook Reader
Networking
- Azure Front Door Domain Contributor
- Azure Front Door Domain Reader
- Azure Front Door Profile Reader
- Azure Front Door Secret Contributor
- Azure Front Door Secret Reader
- CDN Endpoint Contributor
- CDN Endpoint Reader
- CDN Profile Contributor
- CDN Profile Reader
- Classic Network Contributor
- DNS Zone Contributor
- Network Contributor
- Private DNS Zone Contributor
- Traffic Manager Contributor
Privileged
- Contributor
- Owner
- Reservations Administrator
- Role Based Access Control Administrator
- User Access Administrator
Security
- App Compliance Automation Administrator
- App Compliance Automation Reader
- Attestation Contributor
- Attestation Reader
- Key Vault Administrator
- Key Vault Certificate User
- Key Vault Certificates Officer
- Key Vault Contributor
- Key Vault Crypto Officer
- Key Vault Crypto Service Encryption User
- Key Vault Crypto Service Release User
- Key Vault Crypto User
- Key Vault Data Access Administrator
- Key Vault Reader
- Key Vault Secrets Officer
- Key Vault Secrets User
- Locks Contributor
- Managed HSM contributor
- Microsoft Sentinel Automation Contributor
- Microsoft Sentinel Contributor
- Microsoft Sentinel Playbook Operator
- Microsoft Sentinel Reader
- Microsoft Sentinel Responder
- Security Admin
- Security Assessment Contributor
- Security Manager (Legacy)
- Security Reader
Storage
- Avere Contributor
- Avere Operator
- Azure File Sync Administrator
- Azure File Sync Reader
- Backup Contributor
- Backup MUA Admin
- Backup MUA Operator
- Backup Operator
- Backup Reader
- Classic Storage Account Contributor
- Classic Storage Account Key Operator Service Role
- Data Box Contributor
- Data Box Reader
- Data Lake Analytics Developer
- Defender for Storage Data Scanner
- Elastic SAN Network Admin
- Elastic SAN Owner
- Elastic SAN Reader
- Elastic SAN Volume Group Owner
- Reader and Data Access
- Storage Account Backup Contributor
- Storage Account Contributor
- Storage Account Key Operator Service Role
- Storage Actions Blob Data Operator
- Storage Actions Contributor
- Storage Actions Task Assignment Contributor
- Storage Blob Data Contributor
- Storage Blob Data Owner
- Storage Blob Data Reader
- Storage Blob Delegator
- Storage Connector Contributor
- Storage DataShare Contributor
- Storage File Data Privileged Contributor
- Storage File Data Privileged Reader
- Storage File Data SMB Admin
- Storage File Data SMB MI Admin
- Storage File Data SMB Share Contributor
- Storage File Data SMB Share Elevated Contributor
- Storage File Data SMB Share Reader
- Storage File Data SMB Take Ownership
- Storage File Delegator
- Storage Queue Data Contributor
- Storage Queue Data Message Processor
- Storage Queue Data Message Sender
- Storage Queue Data Reader
- Storage Queue Delegator
- Storage Table Data Contributor
- Storage Table Data Reader
- Storage Table Delegator
Web-and-mobile
- Azure Maps Data Contributor
- Azure Maps Data Reader
- Azure Maps Search and Render Data Reader
- Azure Spring Apps Application Configuration Service Config File Pattern Reader Role
- Azure Spring Apps Application Configuration Service Log Reader Role
- Azure Spring Apps Connect Role
- Azure Spring Apps Job Log Reader Role
- Azure Spring Apps Remote Debugging Role
- Azure Spring Apps Spring Cloud Gateway Log Reader Role
- Azure Spring Cloud Config Server Contributor
- Azure Spring Cloud Config Server Reader
- Azure Spring Cloud Data Reader
- Azure Spring Cloud Service Registry Contributor
- Azure Spring Cloud Service Registry Reader
- SignalR AccessKey Reader
- SignalR App Server
- SignalR REST API Owner
- SignalR REST API Reader
- SignalR Service Owner
- SignalR/Web PubSub Contributor
- Web Plan Contributor
- Web PubSub Service Owner
- Web PubSub Service Reader
- Website Contributor