azureblog.co.uk
← cd ~/roles
// roles/azure · devops

DevCenter OwnerAzure built-in role

Provides access to manage all Microsoft.DevCenter resources, and to manage access to Microsoft.DevCenter resources by adding or removing role assignments for the DevCenter Project Admin and DevCenter Dev Box roles.

Role ID4c6569b6-f23e-4295-9b90-bd4cc4ff3292
CategoryDevops
Actions6
Data actions0

Before you assign it

  • It can give access to others. It allows Microsoft.Authorization/roleAssignments/write, so treat it as a privileged role and assign it through PIM where you can.

What it can do

PermissionWhat it allows
Microsoft.DevCenter/*Every operation under Microsoft.DevCenter
Microsoft.Authorization/*/readAny read operation on anything under Microsoft.Authorization
Microsoft.Authorization/roleAssignments/writeCreate a role assignment at the specified scope.
Microsoft.Authorization/roleAssignments/deleteDelete a role assignment at the specified scope.
Microsoft.Resources/deployments/*Every operation under Microsoft.Resources/deployments
Microsoft.Resources/subscriptions/resourceGroups/readGets or lists resource groups.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli
az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "DevCenter Owner" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
powershell3 lines
New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "DevCenter Owner" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
bicep7 lines
resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '4c6569b6-f23e-4295-9b90-bd4cc4ff3292')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4c6569b6-f23e-4295-9b90-bd4cc4ff3292')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "4c6569b6-f23e-4295-9b90-bd4cc4ff3292"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other devops roles

Find the smallest role for a task →

Sources