What are Azure built-in roles?

Azure built-in roles are predefined RBAC (Role-Based Access Control) roles provided by Microsoft Azure. They grant specific permissions to Azure resources and cannot be modified. Examples include Owner, Contributor, Reader, and 862+ specialized roles for services like Storage, Key Vault, and Virtual Machines.

How many Azure built-in roles are there?

There are currently 865 Azure built-in roles. This number grows as Microsoft adds new Azure services and features. This site monitors and tracks all changes to these roles.

What is the difference between Owner, Contributor, and Reader roles?

Owner has full access including the ability to assign roles to others. Contributor can create and manage all resources but cannot grant access to others. Reader can only view resources but cannot make any changes. These are the three fundamental Azure built-in roles.

How do I find the right Azure role for my needs?

Use our Role Recommender tool to find the least-privilege Azure built-in role. Enter the operations you need (like Microsoft.Storage/storageAccounts/read) and get recommendations for the most appropriate role with minimal excess permissions.

Where can I find the role definition ID for an Azure built-in role?

Each Azure built-in role has a unique GUID as its role definition ID. You can find these IDs on this site by clicking on any role to view its details. For example, the Contributor role ID is b24988ac-6180-42a0-ab88-20f7382dd24c.

What are actions, notActions, dataActions, and notDataActions in Azure RBAC?

In Azure RBAC, 'actions' define allowed control plane operations (like managing resources), while 'dataActions' define data plane operations (like reading blob data). 'notActions' and 'notDataActions' are exclusions that remove specific permissions from the allowed set. The effective permissions are: actions minus notActions, and dataActions minus notDataActions.

How often are Azure built-in roles updated by Microsoft?

Microsoft updates Azure built-in roles regularly as new Azure services and features are released. This site monitors for changes daily and shows the complete change history for each role, including what permissions were added or removed.

Can I create custom roles in Azure RBAC?

Yes, Azure allows you to create custom RBAC roles when built-in roles don't meet your needs. Custom roles let you define exact permissions by specifying actions, notActions, dataActions, and notDataActions. However, following the principle of least privilege, it's recommended to use built-in roles when possible.

Azure Built-in Roles List - RBAC Permissions Reference

Role Name	Role ID	Last Updated
Azure Local Disconnected Operations Role	`478d20ba-a53e-4946-b33c-8078a92f2d0a`	2025-08-27
Azure Machine Learning Workspace Connection Secrets Reader	`ea01e6af-a1c1-4350-9563-ad00f8c72ec5`	2023-10-17
Azure Managed Grafana Workspace Contributor	`5c2d7e57-b7c2-4d8a-be4f-82afa42c6e95`	2025-05-20
Azure Maps Contributor	`dba33070-676a-4fb0-87fa-064dc56ff7fb`	2021-11-11
Azure Maps Data Contributor	`8f5e0ce6-4f7b-4dcf-bddf-e6f48634a204`	2021-11-11
Azure Maps Data Read and Batch Role	`d6470a16-71bd-43ab-86b3-6f3a73f4e787`	2023-05-18
Azure Maps Data Reader	`423170ca-a8f6-4b0f-8487-9e4eb8f49bfa`	2021-11-11
Azure Maps Search and Render Data Reader	`6be48352-4f82-47c9-ad5e-0acacefdb005`	2021-11-11
Azure Messaging Catalog Data Owner	`f27b7598-bc64-41f7-8a44-855ff16326c2`	2024-03-29
Azure Messaging Connectors Owner	`ff478a4e-8633-416e-91bc-ec33ce7c9516`	2024-10-25
Azure Migrate Decide and Plan Expert	`7859c0b0-0bb9-4994-bd12-cd529af7d646`	2025-10-20
Azure Migrate Execute Expert	`1cfa4eac-9a23-481c-a793-bfb6958e836b`	2025-10-27
Azure Migrate Management Role	`c20ab07d-648c-4fed-977e-f917d8095dfc`	2024-07-19
Azure Migrate Owner	`fd8ea4d5-6509-4db0-bada-356ab233b4fa`	2025-10-22
Azure Migrate Service Reader	`ba480ccd-6499-4709-b581-8f38bb215c63`	2025-09-17
AzureML Compute Operator	`e503ece1-11d0-4e8e-8e2c-7a6c3bf38815`	2022-09-27
AzureML Data Scientist	`f6c7c914-8db3-469d-8ca1-694a8f32e121`	2023-06-01
AzureML Metrics Writer (preview)	`635dd51f-9968-44d3-b7fb-6d9a6bd613ae`	2021-11-11
AzureML Registry User	`1823dd4f-9b8c-4ab6-ab4e-7397a3684615`	2022-09-27
Azure Monitor Dashboards with Grafana Contributor	`0618ae3d-2930-4bb7-aa00-718db34ee9f9`	2025-11-05
Azure Monitor Pipeline Contributor	`679dc20a-52e8-4ac0-a23c-3b557dfb1e24`	2025-09-05
Azure Monitor Pipeline Reader	`2d50f159-7b96-4f1e-8fc7-fee6957ab7cc`	2025-09-05
Azure Native Dynatrace Agent Management Role	`55077723-1b30-4603-a70b-68de134cfa20`	2025-09-18
Azure Programmable Connectivity Gateway Dataplane User	`c20923c5-b089-47a5-bf67-fd89569c4ad9`	2025-03-20
Azure Programmable Connectivity Gateway User	`609c0c20-e0a0-4a71-b99f-e7e755ac493d`	2024-01-09

Azure Local Disconnected Operations Role

478d20ba-a53e-4946-b33c-8078a92f2d0a

2025-08-27

Azure Machine Learning Workspace Connection Secrets Reader

ea01e6af-a1c1-4350-9563-ad00f8c72ec5

2023-10-17

Azure Managed Grafana Workspace Contributor

5c2d7e57-b7c2-4d8a-be4f-82afa42c6e95

2025-05-20

Azure Maps Contributor

dba33070-676a-4fb0-87fa-064dc56ff7fb

2021-11-11

Azure Maps Data Contributor

8f5e0ce6-4f7b-4dcf-bddf-e6f48634a204

2021-11-11

Azure Maps Data Read and Batch Role

d6470a16-71bd-43ab-86b3-6f3a73f4e787

2023-05-18

Azure Maps Data Reader

423170ca-a8f6-4b0f-8487-9e4eb8f49bfa

2021-11-11

Azure Maps Search and Render Data Reader

6be48352-4f82-47c9-ad5e-0acacefdb005

2021-11-11

Azure Messaging Catalog Data Owner

f27b7598-bc64-41f7-8a44-855ff16326c2

2024-03-29

Azure Messaging Connectors Owner

ff478a4e-8633-416e-91bc-ec33ce7c9516

2024-10-25

Azure Migrate Decide and Plan Expert

7859c0b0-0bb9-4994-bd12-cd529af7d646

2025-10-20

Azure Migrate Execute Expert

1cfa4eac-9a23-481c-a793-bfb6958e836b

2025-10-27

Azure Migrate Management Role

c20ab07d-648c-4fed-977e-f917d8095dfc

2024-07-19

Azure Migrate Owner

fd8ea4d5-6509-4db0-bada-356ab233b4fa

2025-10-22

Azure Migrate Service Reader

ba480ccd-6499-4709-b581-8f38bb215c63

2025-09-17

AzureML Compute Operator

e503ece1-11d0-4e8e-8e2c-7a6c3bf38815

2022-09-27

AzureML Data Scientist

f6c7c914-8db3-469d-8ca1-694a8f32e121

2023-06-01

AzureML Metrics Writer (preview)

635dd51f-9968-44d3-b7fb-6d9a6bd613ae

2021-11-11

AzureML Registry User

1823dd4f-9b8c-4ab6-ab4e-7397a3684615

2022-09-27

Azure Monitor Dashboards with Grafana Contributor

0618ae3d-2930-4bb7-aa00-718db34ee9f9

2025-11-05

Azure Monitor Pipeline Contributor

679dc20a-52e8-4ac0-a23c-3b557dfb1e24

2025-09-05

Azure Monitor Pipeline Reader

2d50f159-7b96-4f1e-8fc7-fee6957ab7cc

2025-09-05

Azure Native Dynatrace Agent Management Role

55077723-1b30-4603-a70b-68de134cfa20

2025-09-18

Azure Programmable Connectivity Gateway Dataplane User

c20923c5-b089-47a5-bf67-fd89569c4ad9

2025-03-20

Azure Programmable Connectivity Gateway User

609c0c20-e0a0-4a71-b99f-e7e755ac493d

2024-01-09

Azure RBAC Built-in Roles