What are Azure built-in roles?

Azure built-in roles are predefined RBAC (Role-Based Access Control) roles provided by Microsoft Azure. They grant specific permissions to Azure resources and cannot be modified. Examples include Owner, Contributor, Reader, and 862+ specialized roles for services like Storage, Key Vault, and Virtual Machines.

How many Azure built-in roles are there?

There are currently 865 Azure built-in roles. This number grows as Microsoft adds new Azure services and features. This site monitors and tracks all changes to these roles.

What is the difference between Owner, Contributor, and Reader roles?

Owner has full access including the ability to assign roles to others. Contributor can create and manage all resources but cannot grant access to others. Reader can only view resources but cannot make any changes. These are the three fundamental Azure built-in roles.

How do I find the right Azure role for my needs?

Use our Role Recommender tool to find the least-privilege Azure built-in role. Enter the operations you need (like Microsoft.Storage/storageAccounts/read) and get recommendations for the most appropriate role with minimal excess permissions.

Where can I find the role definition ID for an Azure built-in role?

Each Azure built-in role has a unique GUID as its role definition ID. You can find these IDs on this site by clicking on any role to view its details. For example, the Contributor role ID is b24988ac-6180-42a0-ab88-20f7382dd24c.

What are actions, notActions, dataActions, and notDataActions in Azure RBAC?

In Azure RBAC, 'actions' define allowed control plane operations (like managing resources), while 'dataActions' define data plane operations (like reading blob data). 'notActions' and 'notDataActions' are exclusions that remove specific permissions from the allowed set. The effective permissions are: actions minus notActions, and dataActions minus notDataActions.

How often are Azure built-in roles updated by Microsoft?

Microsoft updates Azure built-in roles regularly as new Azure services and features are released. This site monitors for changes daily and shows the complete change history for each role, including what permissions were added or removed.

Can I create custom roles in Azure RBAC?

Yes, Azure allows you to create custom RBAC roles when built-in roles don't meet your needs. Custom roles let you define exact permissions by specifying actions, notActions, dataActions, and notDataActions. However, following the principle of least privilege, it's recommended to use built-in roles when possible.

Azure Built-in Roles List - RBAC Permissions Reference

Role Name	Role ID	Last Updated
Azure Resilience Management Goals Contributor	`3910633d-19d0-4d31-b5e6-4f3101b137b9`	2025-10-22
Azure Resilience Management Goals Reader	`39ea2c4e-798a-4469-b81d-65dc7c54cbdb`	2025-10-22
Azure Resilience Management Recovery Administrator	`481d9636-d9f0-468b-b93d-6056318e6f36`	2025-10-23
Azure Resilience Management Recovery Contributor	`4c7fd853-7345-4453-babd-e9481e9b460b`	2025-10-23
Azure Resilience Management Recovery Operator	`517781b0-5ad4-4418-94d5-f2421834b586`	2025-10-23
Azure Resilience Management Recovery Reader	`8210e6a3-4e4c-4e1a-bd83-ef8bac788a45`	2025-10-23
Azure Resource Bridge Deployment Role	`7b1f81f9-4196-4058-8aae-762e593270df`	2024-02-28
Azure Resource Notifications System Topics Subscriber	`0b962ed2-6d56-471c-bd5f-3477d83a7ba4`	2025-10-03
Azure Service Bus Data Owner	`090c5cfd-751d-490a-894a-3ce6f1109419`	2021-11-11
Azure Service Bus Data Receiver	`4f6d3b9b-027b-4f4c-9142-0e5a2a2247e0`	2021-11-11
Azure Service Bus Data Sender	`69a216fc-b8fb-44d8-bc22-1f3c2cd27a39`	2021-11-11
Azure Sphere Contributor	`8b9dfcab-4b77-4632-a6df-94bd07820648`	2023-05-09
Azure Sphere Owner	`5a382001-fe36-41ff-bba4-8bf06bd54da9`	2024-03-14
Azure Sphere Publisher	`6d994134-994b-4a59-9974-f479f0b227fb`	2024-01-30
Azure Sphere Reader	`c8ae6279-5a0b-4cb2-b3f0-d4d62845742c`	2023-05-15
Azure Spring Apps Application Configuration Service Config File Pattern Reader Role	`25211fc6-dc78-40b6-b205-e4ac934fd9fd`	2024-03-29
Azure Spring Apps Application Configuration Service Log Reader Role	`6593e776-2a30-40f9-8a32-4fe28b77655d`	2024-01-15
Azure Spring Apps Connect Role	`80558df3-64f9-4c0f-b32d-e5094b036b0b`	2022-09-23
Azure Spring Apps Job Execution Instance List Role	`91422e52-bb88-4415-bb4a-90f5b71f6dcb`	2024-05-06
Azure Spring Apps Job Log Reader Role	`b459aa1d-e3c8-436f-ae21-c0531140f43e`	2024-05-06
Azure Spring Apps Managed Components Log Reader Role	`52fd16bd-6ed5-46af-9c40-29cbd7952a29`	2024-01-15
Azure Spring Apps Remote Debugging Role	`a99b0159-1064-4c22-a57b-c9b3caa1c054`	2022-09-23
Azure Spring Apps Service Owner	`4037dd68-1cc7-4a64-8765-3a79963a9940`	2025-08-11
Azure Spring Apps Spring Cloud Config Server Log Reader Role	`74252426-c508-480e-9345-4607bbebead4`	2024-05-31
Azure Spring Apps Spring Cloud Gateway Log Reader Role	`4301dc2a-25a9-44b0-ae63-3636cf7f2bd2`	2024-01-15

Azure Resilience Management Goals Contributor

3910633d-19d0-4d31-b5e6-4f3101b137b9

2025-10-22

Azure Resilience Management Goals Reader

39ea2c4e-798a-4469-b81d-65dc7c54cbdb

2025-10-22

Azure Resilience Management Recovery Administrator

481d9636-d9f0-468b-b93d-6056318e6f36

2025-10-23

Azure Resilience Management Recovery Contributor

4c7fd853-7345-4453-babd-e9481e9b460b

2025-10-23

Azure Resilience Management Recovery Operator

517781b0-5ad4-4418-94d5-f2421834b586

2025-10-23

Azure Resilience Management Recovery Reader

8210e6a3-4e4c-4e1a-bd83-ef8bac788a45

2025-10-23

Azure Resource Bridge Deployment Role

7b1f81f9-4196-4058-8aae-762e593270df

2024-02-28

Azure Resource Notifications System Topics Subscriber

0b962ed2-6d56-471c-bd5f-3477d83a7ba4

2025-10-03

Azure Service Bus Data Owner

090c5cfd-751d-490a-894a-3ce6f1109419

2021-11-11

Azure Service Bus Data Receiver

4f6d3b9b-027b-4f4c-9142-0e5a2a2247e0

2021-11-11

Azure Service Bus Data Sender

69a216fc-b8fb-44d8-bc22-1f3c2cd27a39

2021-11-11

Azure Sphere Contributor

8b9dfcab-4b77-4632-a6df-94bd07820648

2023-05-09

Azure Sphere Owner

5a382001-fe36-41ff-bba4-8bf06bd54da9

2024-03-14

Azure Sphere Publisher

6d994134-994b-4a59-9974-f479f0b227fb

2024-01-30

Azure Sphere Reader

c8ae6279-5a0b-4cb2-b3f0-d4d62845742c

2023-05-15

Azure Spring Apps Application Configuration Service Config File Pattern Reader Role

25211fc6-dc78-40b6-b205-e4ac934fd9fd

2024-03-29

Azure Spring Apps Application Configuration Service Log Reader Role

6593e776-2a30-40f9-8a32-4fe28b77655d

2024-01-15

Azure Spring Apps Connect Role

80558df3-64f9-4c0f-b32d-e5094b036b0b

2022-09-23

Azure Spring Apps Job Execution Instance List Role

91422e52-bb88-4415-bb4a-90f5b71f6dcb

2024-05-06

Azure Spring Apps Job Log Reader Role

b459aa1d-e3c8-436f-ae21-c0531140f43e

2024-05-06

Azure Spring Apps Managed Components Log Reader Role

52fd16bd-6ed5-46af-9c40-29cbd7952a29

2024-01-15

Azure Spring Apps Remote Debugging Role

a99b0159-1064-4c22-a57b-c9b3caa1c054

2022-09-23

Azure Spring Apps Service Owner

4037dd68-1cc7-4a64-8765-3a79963a9940

2025-08-11

Azure Spring Apps Spring Cloud Config Server Log Reader Role

74252426-c508-480e-9345-4607bbebead4

2024-05-31

Azure Spring Apps Spring Cloud Gateway Log Reader Role

4301dc2a-25a9-44b0-ae63-3636cf7f2bd2

2024-01-15

Azure RBAC Built-in Roles