// roles/azure · management-and-governance

Scheduled Patching ContributorAzure built-in role

Provides access to manage maintenance configurations with maintenance scope InGuestPatch and corresponding configuration assignments

Role ID	`cd08ab90-6b14-449c-ad9a-8f8e549482c6`
Category	Management-and-governance
Actions	14
Data actions	0

What it can do

Permission	What it allows
`Microsoft.Maintenance/maintenanceConfigurations/read`	Read maintenance configuration.
`Microsoft.Maintenance/maintenanceConfigurations/write`	Create or update maintenance configuration.
`Microsoft.Maintenance/maintenanceConfigurations/delete`	Delete maintenance configuration.
`Microsoft.Maintenance/configurationAssignments/read`	Read maintenance configuration assignment.
`Microsoft.Maintenance/configurationAssignments/write`	Create or update maintenance configuration assignment.
`Microsoft.Maintenance/configurationAssignments/delete`	Delete maintenance configuration assignment.
`Microsoft.Maintenance/configurationAssignments/maintenanceScope/InGuestPatch/read`	Read maintenance configuration assignment for InGuestPatch maintenance scope.
`Microsoft.Maintenance/configurationAssignments/maintenanceScope/InGuestPatch/write`	Create or update a maintenance configuration assignment for InGuestPatch maintenance scope.
`Microsoft.Maintenance/configurationAssignments/maintenanceScope/InGuestPatch/delete`	Delete maintenance configuration assignment for InGuestPatch maintenance scope.
`Microsoft.Maintenance/maintenanceConfigurations/maintenanceScope/InGuestPatch/read`	Read maintenance configuration for InGuestPatch maintenance scope.
`Microsoft.Maintenance/maintenanceConfigurations/maintenanceScope/InGuestPatch/write`	Create or update a maintenance configuration for InGuestPatch maintenance scope.
`Microsoft.Maintenance/maintenanceConfigurations/maintenanceScope/InGuestPatch/delete`	Delete maintenance configuration for InGuestPatch maintenance scope.
`Microsoft.Maintenance/applyUpdates/read`	Read apply updates to a resource.
`Microsoft.Maintenance/updates/read`	Read updates to a resource.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Scheduled Patching Contributor" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Scheduled Patching Contributor" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, 'cd08ab90-6b14-449c-ad9a-8f8e549482c6')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'cd08ab90-6b14-449c-ad9a-8f8e549482c6')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "cd08ab90-6b14-449c-ad9a-8f8e549482c6"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other management-and-governance roles

Service Group Contributor · 1 permission
Template Spec Reader · 1 permission
Carbon Optimization Reader · 2 permissions
Hierarchy Settings Administrator · 2 permissions
Reservations Reader · 2 permissions
Service Group Reader · 2 permissions
Advisor Reviews Reader · 3 permissions
Managed Application Operator Role · 3 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles