// roles/azure · devops

Lab ContributorAzure built-in role

The lab contributor role

Role ID	`5daaa2af-1fe8-407c-9122-bba179798270`
Category	Devops
Actions	27
Data actions	1

Before you assign it

It reaches the data, not just the resource. It has 1 data action, such as reading blobs, secrets or messages.

What it can do

Permission	What it allows
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Insights/alertRules/*`	Every operation under Microsoft.Insights/alertRules
`Microsoft.LabServices/labPlans/images/read`	Get the properties of an image.
`Microsoft.LabServices/labPlans/read`	Get the properties of a lab plan.
`Microsoft.LabServices/labPlans/saveImage/action`	Create an image from a virtual machine in the gallery attached to the lab plan.
`Microsoft.LabServices/labs/read`	Get the properties of a lab.
`Microsoft.LabServices/labs/write`	Create new or update an existing lab.
`Microsoft.LabServices/labs/delete`	Delete the lab and all its users, schedules and virtual machines.
`Microsoft.LabServices/labs/publish/action`	Publish a lab by propagating image of the template virtual machine to all virtual machines in the lab.
`Microsoft.LabServices/labs/syncGroup/action`	Updates the list of users from the Active Directory group assigned to the lab.
`Microsoft.LabServices/labs/schedules/read`	Get the properties of a schedule.
`Microsoft.LabServices/labs/schedules/write`	Create new or update an existing schedule.
`Microsoft.LabServices/labs/schedules/delete`	Delete the schedule.
`Microsoft.LabServices/labs/users/read`	Get the properties of a user.
`Microsoft.LabServices/labs/users/write`	Create new or update an existing user.
`Microsoft.LabServices/labs/users/delete`	Delete the user.
`Microsoft.LabServices/labs/users/invite/action`	Send email invitation to a user to join the lab.
`Microsoft.LabServices/labs/virtualMachines/read`	Get the properties of a virtual machine.
`Microsoft.LabServices/labs/virtualMachines/start/action`	Start a virtual machine.
`Microsoft.LabServices/labs/virtualMachines/stop/action`	Stop and deallocate a virtual machine.
`Microsoft.LabServices/labs/virtualMachines/reimage/action`	Reimage a virtual machine to the last published image.
`Microsoft.LabServices/labs/virtualMachines/redeploy/action`	Redeploy a virtual machine to a different compute node.
`Microsoft.LabServices/labs/virtualMachines/resetPassword/action`	Reset local user's password on a virtual machine.
`Microsoft.LabServices/locations/usages/read`	Get Usage in a location
`Microsoft.LabServices/skus/read`	Get the properties of a Lab Services SKU.
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.

Data actions

Permission	What it allows
`Microsoft.LabServices/labPlans/createLab/action`	Create a new lab from a lab plan.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Lab Contributor" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Lab Contributor" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '5daaa2af-1fe8-407c-9122-bba179798270')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5daaa2af-1fe8-407c-9122-bba179798270')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "5daaa2af-1fe8-407c-9122-bba179798270"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other devops roles

Lab Services Reader · 4 permissions
Playwright Workspace Reader · 4 permissions
Chaos Studio Experiment Contributor · 5 permissions
Playwright Workspace Owner · 5 permissions
Chaos Studio Reader · 6 permissions
DevCenter Owner · 6 permissions
Lab Services Contributor · 6 permissions
Load Test Owner · 6 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles