What are Azure built-in roles?

Azure built-in roles are predefined RBAC (Role-Based Access Control) roles provided by Microsoft Azure. They grant specific permissions to Azure resources and cannot be modified. Examples include Owner, Contributor, Reader, and 862+ specialized roles for services like Storage, Key Vault, and Virtual Machines.

How many Azure built-in roles are there?

There are currently 865 Azure built-in roles. This number grows as Microsoft adds new Azure services and features. This site monitors and tracks all changes to these roles.

What is the difference between Owner, Contributor, and Reader roles?

Owner has full access including the ability to assign roles to others. Contributor can create and manage all resources but cannot grant access to others. Reader can only view resources but cannot make any changes. These are the three fundamental Azure built-in roles.

How do I find the right Azure role for my needs?

Use our Role Recommender tool to find the least-privilege Azure built-in role. Enter the operations you need (like Microsoft.Storage/storageAccounts/read) and get recommendations for the most appropriate role with minimal excess permissions.

Where can I find the role definition ID for an Azure built-in role?

Each Azure built-in role has a unique GUID as its role definition ID. You can find these IDs on this site by clicking on any role to view its details. For example, the Contributor role ID is b24988ac-6180-42a0-ab88-20f7382dd24c.

What are actions, notActions, dataActions, and notDataActions in Azure RBAC?

In Azure RBAC, 'actions' define allowed control plane operations (like managing resources), while 'dataActions' define data plane operations (like reading blob data). 'notActions' and 'notDataActions' are exclusions that remove specific permissions from the allowed set. The effective permissions are: actions minus notActions, and dataActions minus notDataActions.

How often are Azure built-in roles updated by Microsoft?

Microsoft updates Azure built-in roles regularly as new Azure services and features are released. This site monitors for changes daily and shows the complete change history for each role, including what permissions were added or removed.

Can I create custom roles in Azure RBAC?

Yes, Azure allows you to create custom RBAC roles when built-in roles don't meet your needs. Custom roles let you define exact permissions by specifying actions, notActions, dataActions, and notDataActions. However, following the principle of least privilege, it's recommended to use built-in roles when possible.

Azure Built-in Roles List - RBAC Permissions Reference

Role Name	Role ID	Last Updated
Azure Kubernetes Fleet Manager RBAC Cluster Reader	`bd80684d-2f5f-4130-892a-0955546282de`	2024-10-23
Azure Kubernetes Fleet Manager RBAC Cluster Writer	`1dc4cd5a-de51-4ee4-bc8e-b40e9c17e320`	2024-10-23
Azure Kubernetes Fleet Manager RBAC Reader	`30b27cfc-9c84-438e-b0ce-70e35255df80`	2024-10-25
Azure Kubernetes Fleet Manager RBAC Reader for Member Clusters	`463ad26c-fcce-4469-9c7f-5653d8acbab5`	2025-10-24
Azure Kubernetes Fleet Manager RBAC Writer	`5af6afb3-c06c-4fa4-8848-71a8aee05683`	2024-10-23
Azure Kubernetes Fleet Manager RBAC Writer for Member Clusters	`50346970-0998-40f2-b47d-f3b8809840f8`	2025-10-24
Azure Kubernetes Service Agent Pool Manager Role	`1b7f3653-4324-473a-9165-bc55e4d04ba8`	2025-03-10
Azure Kubernetes Service Arc Cluster Admin Role	`b29efa5f-7782-4dc3-9537-4d5bc70a5e9f`	2024-03-11
Azure Kubernetes Service Arc Cluster User Role	`233ca253-b031-42ff-9fba-87ef12d6b55f`	2024-03-11
Azure Kubernetes Service Arc Contributor Role	`5d3f1697-4507-4d08-bb4a-477695db5f82`	2025-09-29
Azure Kubernetes Service Cluster Admin Role	`0ab0b1a8-8aac-4efd-b8c2-3ee1fb270be8`	2022-05-16
Azure Kubernetes Service Cluster Monitoring User	`1afdec4b-e479-420e-99e7-f82237c7c5e6`	2023-02-08
Azure Kubernetes Service Cluster User Role	`4abbcc35-e782-43d8-92c5-2d3f1bd2253f`	2021-11-11
Azure Kubernetes Service Contributor Role	`ed7f3fbd-7b88-4dd4-9017-9adb7ce333f8`	2025-07-24
Azure Kubernetes Service Hybrid Cluster Admin Role	`b5092dac-c796-4349-8681-1a322a31c3f9`	2023-12-04
Azure Kubernetes Service Hybrid Cluster User Role	`fc3f91a1-40bf-4439-8c46-45edbd83563a`	2023-12-04
Azure Kubernetes Service Hybrid Contributor Role	`e7037d40-443a-4434-a3fb-8cd202011e1d`	2023-12-04
Azure Kubernetes Service Machine Manager Role	`8e253927-1f29-4d89-baa2-c3a549eff423`	2025-05-19
Azure Kubernetes Service Namespace Contributor	`289d8817-ee69-43f1-a0af-43a45505b488`	2025-06-16
Azure Kubernetes Service Namespace User	`c9f76ca8-b262-4b10-8ed2-09cf0948aa35`	2025-06-16
Azure Kubernetes Service Policy Add-on Deployment	`18ed5180-3e48-46fd-8541-4ea054d57064`	2022-03-15
Azure Kubernetes Service RBAC Admin	`3498e952-d568-435e-9b2c-8d77e338d7f7`	2023-05-09
Azure Kubernetes Service RBAC Cluster Admin	`b1ff04bb-8a4e-4dc4-8eb5-8693973ce19b`	2022-10-12
Azure Kubernetes Service RBAC Reader	`7f6c6a51-bcf8-42ba-9220-52d62157d7db`	2023-04-26
Azure Kubernetes Service RBAC Writer	`a7ffa36f-339b-4b5c-8bdf-e2c188b2c0eb`	2023-04-26

Azure Kubernetes Fleet Manager RBAC Cluster Reader

bd80684d-2f5f-4130-892a-0955546282de

2024-10-23

Azure Kubernetes Fleet Manager RBAC Cluster Writer

1dc4cd5a-de51-4ee4-bc8e-b40e9c17e320

2024-10-23

Azure Kubernetes Fleet Manager RBAC Reader

30b27cfc-9c84-438e-b0ce-70e35255df80

2024-10-25

Azure Kubernetes Fleet Manager RBAC Reader for Member Clusters

463ad26c-fcce-4469-9c7f-5653d8acbab5

2025-10-24

Azure Kubernetes Fleet Manager RBAC Writer

5af6afb3-c06c-4fa4-8848-71a8aee05683

2024-10-23

Azure Kubernetes Fleet Manager RBAC Writer for Member Clusters

50346970-0998-40f2-b47d-f3b8809840f8

2025-10-24

Azure Kubernetes Service Agent Pool Manager Role

1b7f3653-4324-473a-9165-bc55e4d04ba8

2025-03-10

Azure Kubernetes Service Arc Cluster Admin Role

b29efa5f-7782-4dc3-9537-4d5bc70a5e9f

2024-03-11

Azure Kubernetes Service Arc Cluster User Role

233ca253-b031-42ff-9fba-87ef12d6b55f

2024-03-11

Azure Kubernetes Service Arc Contributor Role

5d3f1697-4507-4d08-bb4a-477695db5f82

2025-09-29

Azure Kubernetes Service Cluster Admin Role

0ab0b1a8-8aac-4efd-b8c2-3ee1fb270be8

2022-05-16

Azure Kubernetes Service Cluster Monitoring User

1afdec4b-e479-420e-99e7-f82237c7c5e6

2023-02-08

Azure Kubernetes Service Cluster User Role

4abbcc35-e782-43d8-92c5-2d3f1bd2253f

2021-11-11

Azure Kubernetes Service Contributor Role

ed7f3fbd-7b88-4dd4-9017-9adb7ce333f8

2025-07-24

Azure Kubernetes Service Hybrid Cluster Admin Role

b5092dac-c796-4349-8681-1a322a31c3f9

2023-12-04

Azure Kubernetes Service Hybrid Cluster User Role

fc3f91a1-40bf-4439-8c46-45edbd83563a

2023-12-04

Azure Kubernetes Service Hybrid Contributor Role

e7037d40-443a-4434-a3fb-8cd202011e1d

2023-12-04

Azure Kubernetes Service Machine Manager Role

8e253927-1f29-4d89-baa2-c3a549eff423

2025-05-19

Azure Kubernetes Service Namespace Contributor

289d8817-ee69-43f1-a0af-43a45505b488

2025-06-16

Azure Kubernetes Service Namespace User

c9f76ca8-b262-4b10-8ed2-09cf0948aa35

2025-06-16

Azure Kubernetes Service Policy Add-on Deployment

18ed5180-3e48-46fd-8541-4ea054d57064

2022-03-15

Azure Kubernetes Service RBAC Admin

3498e952-d568-435e-9b2c-8d77e338d7f7

2023-05-09

Azure Kubernetes Service RBAC Cluster Admin

b1ff04bb-8a4e-4dc4-8eb5-8693973ce19b

2022-10-12

Azure Kubernetes Service RBAC Reader

7f6c6a51-bcf8-42ba-9220-52d62157d7db

2023-04-26

Azure Kubernetes Service RBAC Writer

a7ffa36f-339b-4b5c-8bdf-e2c188b2c0eb

2023-04-26

Azure RBAC Built-in Roles