What are Azure built-in roles?

Azure built-in roles are predefined RBAC (Role-Based Access Control) roles provided by Microsoft Azure. They grant specific permissions to Azure resources and cannot be modified. Examples include Owner, Contributor, Reader, and 862+ specialized roles for services like Storage, Key Vault, and Virtual Machines.

How many Azure built-in roles are there?

There are currently 865 Azure built-in roles. This number grows as Microsoft adds new Azure services and features. This site monitors and tracks all changes to these roles.

What is the difference between Owner, Contributor, and Reader roles?

Owner has full access including the ability to assign roles to others. Contributor can create and manage all resources but cannot grant access to others. Reader can only view resources but cannot make any changes. These are the three fundamental Azure built-in roles.

How do I find the right Azure role for my needs?

Use our Role Recommender tool to find the least-privilege Azure built-in role. Enter the operations you need (like Microsoft.Storage/storageAccounts/read) and get recommendations for the most appropriate role with minimal excess permissions.

Where can I find the role definition ID for an Azure built-in role?

Each Azure built-in role has a unique GUID as its role definition ID. You can find these IDs on this site by clicking on any role to view its details. For example, the Contributor role ID is b24988ac-6180-42a0-ab88-20f7382dd24c.

What are actions, notActions, dataActions, and notDataActions in Azure RBAC?

In Azure RBAC, 'actions' define allowed control plane operations (like managing resources), while 'dataActions' define data plane operations (like reading blob data). 'notActions' and 'notDataActions' are exclusions that remove specific permissions from the allowed set. The effective permissions are: actions minus notActions, and dataActions minus notDataActions.

How often are Azure built-in roles updated by Microsoft?

Microsoft updates Azure built-in roles regularly as new Azure services and features are released. This site monitors for changes daily and shows the complete change history for each role, including what permissions were added or removed.

Can I create custom roles in Azure RBAC?

Yes, Azure allows you to create custom RBAC roles when built-in roles don't meet your needs. Custom roles let you define exact permissions by specifying actions, notActions, dataActions, and notDataActions. However, following the principle of least privilege, it's recommended to use built-in roles when possible.

Azure Built-in Roles List - RBAC Permissions Reference

Total Roles

865

Last Scan

2025-12-21 22:28

Type

All Created Updated Deleted

Period

7d 15d 30d 90d 1y

8 changes found

Updated	Role	Event
2025-12-19	DevCenter Project Admin `331c37c6-af14-46d9-b9f4-e1909e1b95a0`	Updated Edit
2025-12-19	Defender for Storage Data Scanner `1e7ca9b1-60d1-4db8-a914-f2ca1ff27c40`	Updated Edit
2025-12-18	Fabric Resource Management Administrator `337a31c1-4e14-4ef9-83ed-584bb8d2b70a`	Updated Edit
2025-12-18	Azure Stack HCI Device Management Role `865ae368-6a45-4bd1-8fbf-0d5151f56fc1`	Updated Edit
2025-12-17	Defender Serverless Scanner `68ac31b4-936a-4046-a6d2-ba6f8a757bf6`	Updated Edit
2025-12-17	Log Analytics Contributor `92aaf0da-9dab-42b6-94a3-d43ce8d16293`	Updated Edit
2025-12-17	Log Analytics Reader `73c42c96-874c-492b-b04d-ab87d138a893`	Updated Edit
2025-12-15	Log Analytics Reader `73c42c96-874c-492b-b04d-ab87d138a893`	Updated Edit

Azure RBAC Recent Changes