// roles/azure · devops

DevCenter Project AdminAzure built-in role

Provides access to manage project resources.

Role ID	`331c37c6-af14-46d9-b9f4-e1909e1b95a0`
Category	Devops
Actions	4 (minus 2 NotActions)
Data actions	27

Before you assign it

It reaches the data, not just the resource. It has 27 data actions, such as reading blobs, secrets or messages.

What it can do

Permission	What it allows
`Microsoft.DevCenter/projects/*`	Every operation under Microsoft.DevCenter/projects
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.

Can't do

These are taken away from the actions above.

Permission	What it allows
`Microsoft.DevCenter/projects/write`	Creates or updates a project.
`Microsoft.DevCenter/projects/delete`	Deletes a project resource.

Data actions

Permission	What it allows
`Microsoft.DevCenter/projects/users/devboxes/adminStart/action`	Allows a user to start any Dev Box resource.
`Microsoft.DevCenter/projects/users/devboxes/adminStop/action`	Allows a user to stop any Dev Box resource.
`Microsoft.DevCenter/projects/users/devboxes/adminRead/action`	Allows a user read access to any Dev Box resource.
`Microsoft.DevCenter/projects/users/devboxes/adminWrite/action`	Allows a user write access to any Dev Box resource.
`Microsoft.DevCenter/projects/users/devboxes/adminDelete/action`	Allows a user to delete any Dev Box resource.
`Microsoft.DevCenter/projects/users/devboxes/adminAlign/action`	Allows an admin to align a Dev Box with the pool configuration.
`Microsoft.DevCenter/projects/users/devboxes/adminActionRead/action`	Allows an admin to read dev box actions.
`Microsoft.DevCenter/projects/users/devboxes/adminActionManage/action`	Allows an admin to skip or delay dev box actions.
`Microsoft.DevCenter/projects/users/devboxes/userStop/action`	Allows a user to stop their own Dev Box resources.
`Microsoft.DevCenter/projects/users/devboxes/userStart/action`	Allows a user to start their own Dev Box resources.
`Microsoft.DevCenter/projects/users/devboxes/userGetRemoteConnection/action`	Allows a user to get the RDP connection information for their own Dev Box resources.
`Microsoft.DevCenter/projects/users/devboxes/userRead/action`	Allows a user to read their own Dev Box resources.
`Microsoft.DevCenter/projects/users/devboxes/userWrite/action`	Allows a user to create and update their own Dev Box resources.
`Microsoft.DevCenter/projects/users/devboxes/userDelete/action`	Allows a user to delete their own Dev Box resources.
`Microsoft.DevCenter/projects/users/devboxes/userActionRead/action`	Allows a user to read dev box actions.
`Microsoft.DevCenter/projects/users/devboxes/userActionManage/action`	Allows a user to skip or delay dev box actions.
`Microsoft.DevCenter/projects/users/devboxes/userCustomize/action`	Allows a user to customize their own Dev Box resources.
`Microsoft.DevCenter/projects/users/environments/adminRead/action`	Allows a project administrator to read all of the environments in a project.
`Microsoft.DevCenter/projects/users/environments/userWrite/action`	Allows a user to write the environments they have access to in a project.
`Microsoft.DevCenter/projects/users/environments/adminWrite/action`	Allows a project administrator to write all of the environments in a project.
`Microsoft.DevCenter/projects/users/environments/userDelete/action`	Allows a user to delete the environments they have access to in a project.
`Microsoft.DevCenter/projects/users/environments/adminDelete/action`	Allows a project administrator to delete all of the environments in a project.
`Microsoft.DevCenter/projects/users/environments/adminAction/action`	Allows a project administrator to perform an action on all of the environments in a project.
`Microsoft.DevCenter/projects/users/environments/adminActionRead/action`	Allows an admin to read environment actions.
`Microsoft.DevCenter/projects/users/environments/adminActionManage/action`	Allows an admin to skip, delay etc. environment actions.
`Microsoft.DevCenter/projects/users/environments/adminOutputsRead/action`	Allows an admin to read Output values from environment deployment.
`Microsoft.DevCenter/projects/pools/align/action`	Allows a user to align all virtual machines in the pool.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "DevCenter Project Admin" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "DevCenter Project Admin" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '331c37c6-af14-46d9-b9f4-e1909e1b95a0')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '331c37c6-af14-46d9-b9f4-e1909e1b95a0')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "331c37c6-af14-46d9-b9f4-e1909e1b95a0"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other devops roles

Lab Services Reader · 4 permissions
Playwright Workspace Reader · 4 permissions
Chaos Studio Experiment Contributor · 5 permissions
Playwright Workspace Owner · 5 permissions
Chaos Studio Reader · 6 permissions
DevCenter Owner · 6 permissions
Lab Services Contributor · 6 permissions
Load Test Owner · 6 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles