← cd ~/roles
// roles/azure · compute
Azure Batch Account ContributorAzure built-in role
Grants full access to manage all Batch resources, including Batch accounts, pools and jobs.
| Role ID | 29fe4964-1e60-436b-bd3a-77fd4c178b3c |
|---|---|
| Category | Compute |
| Actions | 5 |
| Data actions | 1 |
Before you assign it
- It reaches the data, not just the resource. It has 1 data action, such as reading blobs, secrets or messages.
What it can do
| Permission | What it allows |
|---|---|
Microsoft.Authorization/*/read | Any read operation on anything under Microsoft.Authorization |
Microsoft.Batch/* | Every operation under Microsoft.Batch |
Microsoft.Insights/alertRules/* | Every operation under Microsoft.Insights/alertRules |
Microsoft.Resources/deployments/* | Every operation under Microsoft.Resources/deployments |
Microsoft.Resources/subscriptions/resourceGroups/read | Gets or lists resource groups. |
Data actions
| Permission | What it allows |
|---|---|
Microsoft.Batch/* | Every operation under Microsoft.Batch |
Assign it
Scope it as tightly as you can: a resource or resource group rather than the whole subscription.
az role assignment create \
--assignee "jane.doe@contoso.com" \
--role "Azure Batch Account Contributor" \
--scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
-RoleDefinitionName "Azure Batch Account Contributor" `
-Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
name: guid(resourceGroup().id, principalId, '29fe4964-1e60-436b-bd3a-77fd4c178b3c')
properties: {
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '29fe4964-1e60-436b-bd3a-77fd4c178b3c')
principalId: principalId
}
}Who already has it?
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "29fe4964-1e60-436b-bd3a-77fd4c178b3c"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)Other compute roles
- Compute Gallery Sharing Admin · 1 permission
- Compute Gallery Image Reader · 2 permissions
- Desktop Virtualization User · 2 permissions
- Virtual Machine Local User Login · 2 permissions
- Azure Batch Account Reader · 3 permissions
- Disk Backup Reader · 3 permissions
- Data Operator for Managed Disks · 4 permissions
- Windows 365 Network User · 4 permissions