← cd ~/roles
// roles/azure · privileged
ContributorAzure built-in role
Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries.
| Role ID | b24988ac-6180-42a0-ab88-20f7382dd24c |
|---|---|
| Category | Privileged |
| Actions | 1 (minus 11 NotActions) |
| Data actions | 0 |
Before you assign it
- Full control. It includes
*, so it can do almost anything to resources in scope, except the 11 operations listed under "Can't do".
What it can do
| Permission | What it allows |
|---|---|
* | Every operation on every resource type |
Can't do
These are taken away from the actions above.
| Permission | What it allows |
|---|---|
Microsoft.Authorization/*/Delete | Any delete operation on anything under Microsoft.Authorization |
Microsoft.Authorization/*/Write | Any write operation on anything under Microsoft.Authorization |
Microsoft.Authorization/elevateAccess/Action | Grants the caller User Access Administrator access at the tenant scope |
Microsoft.Blueprint/blueprintAssignments/write | Create or update any blueprint artifacts |
Microsoft.Blueprint/blueprintAssignments/delete | Delete any blueprint artifacts |
Microsoft.Compute/galleries/share/action | Shares a Gallery to different scopes |
Microsoft.Purview/consents/write | Create or Update a Consent Resource. |
Microsoft.Purview/consents/delete | Delete the Consent Resource. |
Microsoft.Resources/deploymentStacks/manageDenySetting/action | Manage the denySettings property of a deployment stack. |
Microsoft.Subscription/cancel/action | Cancels the Subscription |
Microsoft.Subscription/enable/action | Reactivates the Subscription |
Assign it
Scope it as tightly as you can: a resource or resource group rather than the whole subscription.
az role assignment create \
--assignee "jane.doe@contoso.com" \
--role "Contributor" \
--scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
-RoleDefinitionName "Contributor" `
-Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
name: guid(resourceGroup().id, principalId, 'b24988ac-6180-42a0-ab88-20f7382dd24c')
properties: {
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')
principalId: principalId
}
}Who already has it?
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "b24988ac-6180-42a0-ab88-20f7382dd24c"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)Other privileged roles
- Owner · 1 permission
- User Access Administrator · 3 permissions
- Role Based Access Control Administrator · 4 permissions
- Reservations Administrator · 7 permissions