// roles/azure · identity

Domain Services ContributorAzure built-in role

Can manage Azure AD Domain Services and related network configurations

Role ID	`eeaeda52-9324-47f6-8069-5d5bade478b2`
Category	Identity
Actions	69
Data actions	0

What it can do

Permission	What it allows
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Resources/deployments/read`	Gets or lists deployments.
`Microsoft.Resources/deployments/write`	Creates or updates an deployment.
`Microsoft.Resources/deployments/delete`	Deletes a deployment.
`Microsoft.Resources/deployments/cancel/action`	Cancels a deployment.
`Microsoft.Resources/deployments/validate/action`	Validates a deployment.
`Microsoft.Resources/deployments/whatIf/action`	Predicts template deployment changes.
`Microsoft.Resources/deployments/exportTemplate/action`	Export template for a deployment
`Microsoft.Resources/deployments/operations/read`	Gets or lists deployment operations.
`Microsoft.Resources/deployments/operationstatuses/read`	Gets or lists deployment operation statuses.
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Insights/AlertRules/Write`	Create or update a classic metric alert
`Microsoft.Insights/AlertRules/Delete`	Delete a classic metric alert
`Microsoft.Insights/AlertRules/Read`	Read a classic metric alert
`Microsoft.Insights/AlertRules/Activated/Action`	Classic metric alert activated
`Microsoft.Insights/AlertRules/Resolved/Action`	Classic metric alert resolved
`Microsoft.Insights/AlertRules/Throttled/Action`	Classic metric alert rule throttled
`Microsoft.Insights/AlertRules/Incidents/Read`	Read a classic metric alert incident
`Microsoft.Insights/Logs/Read`	Reading data from all your logs
`Microsoft.Insights/Metrics/Read`	Read metrics
`Microsoft.Insights/DiagnosticSettings/*`	Every operation under Microsoft.Insights/DiagnosticSettings
`Microsoft.Insights/DiagnosticSettingsCategories/Read`	Read diagnostic settings categories
`Microsoft.AAD/register/action`	Subscription Registration Action
`Microsoft.AAD/unregister/action`	Unregister Domain Service
`Microsoft.AAD/domainServices/*`	Every operation under Microsoft.AAD/domainServices
`Microsoft.Network/register/action`	Registers the subscription
`Microsoft.Network/unregister/action`	Unregisters the subscription
`Microsoft.Network/virtualNetworks/read`	Get the virtual network definition
`Microsoft.Network/virtualNetworks/write`	Creates a virtual network or updates an existing virtual network
`Microsoft.Network/virtualNetworks/delete`	Deletes a virtual network
`Microsoft.Network/virtualNetworks/peer/action`	Peers a virtual network with another virtual network
`Microsoft.Network/virtualNetworks/join/action`	Joins a virtual network. Not Alertable.
`Microsoft.Network/virtualNetworks/subnets/read`	Gets a virtual network subnet definition
`Microsoft.Network/virtualNetworks/subnets/write`	Creates a virtual network subnet or updates an existing virtual network subnet
`Microsoft.Network/virtualNetworks/subnets/delete`	Deletes a virtual network subnet
`Microsoft.Network/virtualNetworks/subnets/join/action`	Joins a virtual network. Not Alertable.
`Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read`	Gets a virtual network peering definition
`Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write`	Creates a virtual network peering or updates an existing virtual network peering
`Microsoft.Network/virtualNetworks/virtualNetworkPeerings/delete`	Deletes a virtual network peering
`Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/diagnosticSettings/read`	Get the diagnostic settings of Virtual Network
`Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read`	Gets available metrics for the PingMesh
`Microsoft.Network/azureFirewalls/read`	Get Azure Firewall
`Microsoft.Network/ddosProtectionPlans/read`	Gets a DDoS Protection Plan
`Microsoft.Network/ddosProtectionPlans/join/action`	Joins a DDoS Protection Plan. Not alertable.
`Microsoft.Network/loadBalancers/read`	Gets a load balancer definition
`Microsoft.Network/loadBalancers/delete`	Deletes a load balancer
`Microsoft.Network/loadBalancers/*/read`	Any read operation on anything under Microsoft.Network/loadBalancers
`Microsoft.Network/loadBalancers/backendAddressPools/join/action`	Joins a load balancer backend address pool. Not Alertable.
`Microsoft.Network/loadBalancers/inboundNatRules/join/action`	Joins a load balancer inbound nat rule. Not Alertable.
`Microsoft.Network/natGateways/join/action`	Joins a NAT Gateway
`Microsoft.Network/networkInterfaces/read`	Gets a network interface definition.
`Microsoft.Network/networkInterfaces/write`	Creates a network interface or updates an existing network interface.
`Microsoft.Network/networkInterfaces/delete`	Deletes a network interface
`Microsoft.Network/networkInterfaces/join/action`	Joins a Virtual Machine to a network interface. Not Alertable.
`Microsoft.Network/networkSecurityGroups/defaultSecurityRules/read`	Gets a default security rule definition
`Microsoft.Network/networkSecurityGroups/read`	Gets a network security group definition
`Microsoft.Network/networkSecurityGroups/write`	Creates a network security group or updates an existing network security group
`Microsoft.Network/networkSecurityGroups/delete`	Deletes a network security group
`Microsoft.Network/networkSecurityGroups/join/action`	Joins a network security group. Not Alertable.
`Microsoft.Network/networkSecurityGroups/securityRules/read`	Gets a security rule definition
`Microsoft.Network/networkSecurityGroups/securityRules/write`	Creates a security rule or updates an existing security rule
`Microsoft.Network/networkSecurityGroups/securityRules/delete`	Deletes a security rule
`Microsoft.Network/routeTables/read`	Gets a route table definition
`Microsoft.Network/routeTables/write`	Creates a route table or Updates an existing route table
`Microsoft.Network/routeTables/delete`	Deletes a route table definition
`Microsoft.Network/routeTables/join/action`	Joins a route table. Not Alertable.
`Microsoft.Network/routeTables/routes/read`	Gets a route definition
`Microsoft.Network/routeTables/routes/write`	Creates a route or Updates an existing route
`Microsoft.Network/routeTables/routes/delete`	Deletes a route definition

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Domain Services Contributor" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Domain Services Contributor" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, 'eeaeda52-9324-47f6-8069-5d5bade478b2')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "eeaeda52-9324-47f6-8069-5d5bade478b2"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other identity roles

Managed Identity Operator · 7 permissions
Managed Identity Contributor · 12 permissions
Domain Services Reader · 28 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles