What are Azure built-in roles?

Azure built-in roles are predefined RBAC (Role-Based Access Control) roles provided by Microsoft Azure. They grant specific permissions to Azure resources and cannot be modified. Examples include Owner, Contributor, Reader, and 862+ specialized roles for services like Storage, Key Vault, and Virtual Machines.

How many Azure built-in roles are there?

There are currently 865 Azure built-in roles. This number grows as Microsoft adds new Azure services and features. This site monitors and tracks all changes to these roles.

What is the difference between Owner, Contributor, and Reader roles?

Owner has full access including the ability to assign roles to others. Contributor can create and manage all resources but cannot grant access to others. Reader can only view resources but cannot make any changes. These are the three fundamental Azure built-in roles.

How do I find the right Azure role for my needs?

Use our Role Recommender tool to find the least-privilege Azure built-in role. Enter the operations you need (like Microsoft.Storage/storageAccounts/read) and get recommendations for the most appropriate role with minimal excess permissions.

Where can I find the role definition ID for an Azure built-in role?

Each Azure built-in role has a unique GUID as its role definition ID. You can find these IDs on this site by clicking on any role to view its details. For example, the Contributor role ID is b24988ac-6180-42a0-ab88-20f7382dd24c.

What are actions, notActions, dataActions, and notDataActions in Azure RBAC?

In Azure RBAC, 'actions' define allowed control plane operations (like managing resources), while 'dataActions' define data plane operations (like reading blob data). 'notActions' and 'notDataActions' are exclusions that remove specific permissions from the allowed set. The effective permissions are: actions minus notActions, and dataActions minus notDataActions.

How often are Azure built-in roles updated by Microsoft?

Microsoft updates Azure built-in roles regularly as new Azure services and features are released. This site monitors for changes daily and shows the complete change history for each role, including what permissions were added or removed.

Can I create custom roles in Azure RBAC?

Yes, Azure allows you to create custom RBAC roles when built-in roles don't meet your needs. Custom roles let you define exact permissions by specifying actions, notActions, dataActions, and notDataActions. However, following the principle of least privilege, it's recommended to use built-in roles when possible.

Azure Built-in Roles List - RBAC Permissions Reference

Role Name	Role ID	Last Updated
API Management Workspace Contributor	`0c34c906-8d99-4cb7-8bb7-33f5b0a1a799`	2025-05-16
API Management Workspace Reader	`ef1c2c96-4a77-49e8-b9a4-6179fe1d2fd2`	2025-05-16
App Compliance Automation Administrator	`0f37683f-2463-46b6-9ce7-9b788b988ba2`	2025-04-22
App Compliance Automation Reader	`ffc6bbe0-e443-4c3b-bf54-26581bb2f78e`	2025-04-22
App Configuration Contributor	`fe86443c-f201-4fc4-9d2a-ac61149fbda0`	2024-09-17
App Configuration Data Owner	`5ae67dd6-50cb-40e7-96ff-dc2bfa4b606b`	2024-10-29
App Configuration Data Reader	`516239f1-63e1-4d78-a4de-a74fb236a071`	2021-11-11
App Configuration Reader	`175b81b9-6e0d-490a-85e4-0d422273c10c`	2024-09-17
AppGw for Containers Configuration Manager	`fbc52c3f-28ad-4303-a892-8a056630b8f1`	2024-10-31
Application Group Contributor	`ca6382a4-1721-4bcf-a114-ff0c70227b6b`	2021-11-11
Application Insights Component Contributor	`ae349356-3a1b-4a5e-921d-050484c6347e`	2021-11-11
Application Insights Snapshot Debugger	`08954f03-6346-4c2e-81c0-ec3a5cfae23b`	2025-10-28
App Service Environment Contributor	`8ea85a25-eb16-4e29-ab4d-6f2a26c711a2`	2024-11-13
Arc Container Storage Contributor	`ee99642a-225b-4fe8-a771-9d9036053e87`	2025-12-17
Arc Gateway Manager	`f6e92014-8af2-414d-9948-9b1abf559285`	2025-05-12
ArizeAi.ObservabilityEval Contributor Role	`dca88c6f-5090-44cd-a0ff-a88f337b12a5`	2025-08-08
ARN Service Event Grid Subscriber Role	`dc0882cc-bc27-4d21-9ea2-f821aaa10fb1`	2025-11-07
Attestation Contributor	`bbf86eb8-f7b4-4cce-96e4-18cddf81d86e`	2021-11-11
Attestation Reader	`fd1bd22b-8476-40bc-a0bc-69b95687b9f3`	2024-07-15
Auto Actions Contributor	`a8d01690-9418-4783-8ca2-9f0f1791783d`	2025-02-20
Automation Contributor	`f353d9bd-d4a6-484e-a77a-8050b599b867`	2021-11-11
Automation Job Operator	`4fe576fe-1146-4730-92eb-48519fa6bf9f`	2021-11-11
Automation Operator	`d3881f73-407a-4167-8283-e981cbba0404`	2021-11-11
Automation Runbook Operator	`5fb5aef8-1081-4b8e-bb16-9d5d0385bab5`	2021-11-11
Autonomous Development Platform Data Contributor (Preview)	`b8b15564-4fa6-4a59-ab12-03e1d9594795`	2022-09-15

API Management Workspace Contributor

0c34c906-8d99-4cb7-8bb7-33f5b0a1a799

2025-05-16

API Management Workspace Reader

ef1c2c96-4a77-49e8-b9a4-6179fe1d2fd2

2025-05-16

App Compliance Automation Administrator

0f37683f-2463-46b6-9ce7-9b788b988ba2

2025-04-22

App Compliance Automation Reader

ffc6bbe0-e443-4c3b-bf54-26581bb2f78e

2025-04-22

App Configuration Contributor

fe86443c-f201-4fc4-9d2a-ac61149fbda0

2024-09-17

App Configuration Data Owner

5ae67dd6-50cb-40e7-96ff-dc2bfa4b606b

2024-10-29

App Configuration Data Reader

516239f1-63e1-4d78-a4de-a74fb236a071

2021-11-11

App Configuration Reader

175b81b9-6e0d-490a-85e4-0d422273c10c

2024-09-17

AppGw for Containers Configuration Manager

fbc52c3f-28ad-4303-a892-8a056630b8f1

2024-10-31

Application Group Contributor

ca6382a4-1721-4bcf-a114-ff0c70227b6b

2021-11-11

Application Insights Component Contributor

ae349356-3a1b-4a5e-921d-050484c6347e

2021-11-11

Application Insights Snapshot Debugger

08954f03-6346-4c2e-81c0-ec3a5cfae23b

2025-10-28

App Service Environment Contributor

8ea85a25-eb16-4e29-ab4d-6f2a26c711a2

2024-11-13

Arc Container Storage Contributor

ee99642a-225b-4fe8-a771-9d9036053e87

2025-12-17

Arc Gateway Manager

f6e92014-8af2-414d-9948-9b1abf559285

2025-05-12

ArizeAi.ObservabilityEval Contributor Role

dca88c6f-5090-44cd-a0ff-a88f337b12a5

2025-08-08

ARN Service Event Grid Subscriber Role

dc0882cc-bc27-4d21-9ea2-f821aaa10fb1

2025-11-07

Attestation Contributor

bbf86eb8-f7b4-4cce-96e4-18cddf81d86e

2021-11-11

Attestation Reader

fd1bd22b-8476-40bc-a0bc-69b95687b9f3

2024-07-15

Auto Actions Contributor

a8d01690-9418-4783-8ca2-9f0f1791783d

2025-02-20

Automation Contributor

f353d9bd-d4a6-484e-a77a-8050b599b867

2021-11-11

Automation Job Operator

4fe576fe-1146-4730-92eb-48519fa6bf9f

2021-11-11

Automation Operator

d3881f73-407a-4167-8283-e981cbba0404

2021-11-11

Automation Runbook Operator

5fb5aef8-1081-4b8e-bb16-9d5d0385bab5

2021-11-11

Autonomous Development Platform Data Contributor (Preview)

b8b15564-4fa6-4a59-ab12-03e1d9594795

2022-09-15