What are Azure built-in roles?

Azure built-in roles are predefined RBAC (Role-Based Access Control) roles provided by Microsoft Azure. They grant specific permissions to Azure resources and cannot be modified. Examples include Owner, Contributor, Reader, and 862+ specialized roles for services like Storage, Key Vault, and Virtual Machines.

How many Azure built-in roles are there?

There are currently 865 Azure built-in roles. This number grows as Microsoft adds new Azure services and features. This site monitors and tracks all changes to these roles.

What is the difference between Owner, Contributor, and Reader roles?

Owner has full access including the ability to assign roles to others. Contributor can create and manage all resources but cannot grant access to others. Reader can only view resources but cannot make any changes. These are the three fundamental Azure built-in roles.

How do I find the right Azure role for my needs?

Use our Role Recommender tool to find the least-privilege Azure built-in role. Enter the operations you need (like Microsoft.Storage/storageAccounts/read) and get recommendations for the most appropriate role with minimal excess permissions.

Where can I find the role definition ID for an Azure built-in role?

Each Azure built-in role has a unique GUID as its role definition ID. You can find these IDs on this site by clicking on any role to view its details. For example, the Contributor role ID is b24988ac-6180-42a0-ab88-20f7382dd24c.

What are actions, notActions, dataActions, and notDataActions in Azure RBAC?

In Azure RBAC, 'actions' define allowed control plane operations (like managing resources), while 'dataActions' define data plane operations (like reading blob data). 'notActions' and 'notDataActions' are exclusions that remove specific permissions from the allowed set. The effective permissions are: actions minus notActions, and dataActions minus notDataActions.

How often are Azure built-in roles updated by Microsoft?

Microsoft updates Azure built-in roles regularly as new Azure services and features are released. This site monitors for changes daily and shows the complete change history for each role, including what permissions were added or removed.

Can I create custom roles in Azure RBAC?

Yes, Azure allows you to create custom RBAC roles when built-in roles don't meet your needs. Custom roles let you define exact permissions by specifying actions, notActions, dataActions, and notDataActions. However, following the principle of least privilege, it's recommended to use built-in roles when possible.

Azure Built-in Roles List - RBAC Permissions Reference

Role Name	Role ID	Last Updated
Azure Red Hat OpenShift Cloud Controller Manager	`a1f96423-95ce-4224-ab27-4e3dc72facd4`	2025-11-12
Azure Red Hat OpenShift Cluster Ingress Operator	`0336e1d3-7a87-462b-b6db-342b63f7802c`	2025-02-18
Azure Red Hat OpenShift Disk Storage Operator	`5b7237c5-45e1-49d6-bc18-a1f62f400748`	2025-04-01
Azure Red Hat OpenShift Federated Credential	`ef318e2a-8334-4a05-9e4a-295a196c6a6e`	2025-03-13
Azure Red Hat OpenShift File Storage Operator	`0d7aedc0-15fd-4a67-a412-efad370c947e`	2025-07-29
Azure Red Hat OpenShift First Party Network	`42f3c60f-e7b1-46d7-ba56-6de681664342`	2025-12-18
Azure Red Hat OpenShift Hosted Control Planes Cluster API Provider	`88366f10-ed47-4cc0-9fab-c8a06148393e`	2025-08-06
Azure Red Hat OpenShift Hosted Control Planes Control Plane Operator	`fc0c873f-45e9-4d0d-a7d1-585aab30c6ed`	2025-05-06
Azure Red Hat OpenShift Hosted Control Planes Service Managed Identity	`c0ff367d-66d8-445e-917c-583feb0ef0d4`	2025-05-06
Azure Red Hat OpenShift Image Registry Operator	`8b32b316-c2f5-4ddf-b05b-83dacd2d08b5`	2025-07-29
Azure Red Hat OpenShift Machine API Operator	`0358943c-7e01-48ba-8889-02cc51d78637`	2025-03-24
Azure Red Hat OpenShift Network Operator	`be7a6435-15ae-4171-8f30-4a343eff9e8f`	2025-05-08
Azure Red Hat OpenShift Service Operator	`4436bae4-7702-4c84-919b-c4069ff25ee2`	2025-06-05
Azure Relay Listener	`26e0b698-aa6d-4085-9386-aadae190014d`	2021-11-11
Azure Relay Owner	`2787bf04-f1f5-4bfe-8383-c8a24483ee38`	2021-11-11
Azure Relay Sender	`26baccc8-eea7-41f1-98f4-1762cc7f685d`	2021-11-11
Azure Resilience Management Drills Administrator	`c914561b-1575-4601-af9c-a1356bf59818`	2025-11-04
Azure Resilience Management Drills Assets Administrator	`5a2ec2f1-2375-4950-9906-59ec1d979249`	2025-11-04
Azure Resilience Management Drills Assets Contributor	`344b740c-5e7c-4d32-89b2-ee3b51cb89bc`	2025-11-04
Azure Resilience Management Drills Contributor	`e131102b-11a5-4ff4-8508-ed922132b74c`	2025-11-04
Azure Resilience Management Drills Operator	`ff09793b-be48-49f6-ad96-70d32039c0b9`	2025-10-22
Azure Resilience Management Drills Reader	`d2e8fe82-9212-490f-af3e-34bb52d87d3d`	2025-09-22
Azure Resilience Management Drills Target Resource Administrator	`e4c7f620-39b8-4688-bba2-70dd82ef367b`	2025-11-04
Azure Resilience Management Drills Target Resource Contributor	`82c6a823-ae9c-4b90-b5c5-bff581c45896`	2025-11-04
Azure Resilience Management Goals Administrator	`a2b7cc47-30ec-462f-a2f4-9ac6e1c266af`	2025-10-22

Azure Red Hat OpenShift Cloud Controller Manager

a1f96423-95ce-4224-ab27-4e3dc72facd4

2025-11-12

Azure Red Hat OpenShift Cluster Ingress Operator

0336e1d3-7a87-462b-b6db-342b63f7802c

2025-02-18

Azure Red Hat OpenShift Disk Storage Operator

5b7237c5-45e1-49d6-bc18-a1f62f400748

2025-04-01

Azure Red Hat OpenShift Federated Credential

ef318e2a-8334-4a05-9e4a-295a196c6a6e

2025-03-13

Azure Red Hat OpenShift File Storage Operator

0d7aedc0-15fd-4a67-a412-efad370c947e

2025-07-29

Azure Red Hat OpenShift First Party Network

42f3c60f-e7b1-46d7-ba56-6de681664342

2025-12-18

Azure Red Hat OpenShift Hosted Control Planes Cluster API Provider

88366f10-ed47-4cc0-9fab-c8a06148393e

2025-08-06

Azure Red Hat OpenShift Hosted Control Planes Control Plane Operator

fc0c873f-45e9-4d0d-a7d1-585aab30c6ed

2025-05-06

Azure Red Hat OpenShift Hosted Control Planes Service Managed Identity

c0ff367d-66d8-445e-917c-583feb0ef0d4

2025-05-06

Azure Red Hat OpenShift Image Registry Operator

8b32b316-c2f5-4ddf-b05b-83dacd2d08b5

2025-07-29

Azure Red Hat OpenShift Machine API Operator

0358943c-7e01-48ba-8889-02cc51d78637

2025-03-24

Azure Red Hat OpenShift Network Operator

be7a6435-15ae-4171-8f30-4a343eff9e8f

2025-05-08

Azure Red Hat OpenShift Service Operator

4436bae4-7702-4c84-919b-c4069ff25ee2

2025-06-05

Azure Relay Listener

26e0b698-aa6d-4085-9386-aadae190014d

2021-11-11

Azure Relay Owner

2787bf04-f1f5-4bfe-8383-c8a24483ee38

2021-11-11

Azure Relay Sender

26baccc8-eea7-41f1-98f4-1762cc7f685d

2021-11-11

Azure Resilience Management Drills Administrator

c914561b-1575-4601-af9c-a1356bf59818

2025-11-04

Azure Resilience Management Drills Assets Administrator

5a2ec2f1-2375-4950-9906-59ec1d979249

2025-11-04

Azure Resilience Management Drills Assets Contributor

344b740c-5e7c-4d32-89b2-ee3b51cb89bc

2025-11-04

Azure Resilience Management Drills Contributor

e131102b-11a5-4ff4-8508-ed922132b74c

2025-11-04

Azure Resilience Management Drills Operator

ff09793b-be48-49f6-ad96-70d32039c0b9

2025-10-22

Azure Resilience Management Drills Reader

d2e8fe82-9212-490f-af3e-34bb52d87d3d

2025-09-22

Azure Resilience Management Drills Target Resource Administrator

e4c7f620-39b8-4688-bba2-70dd82ef367b

2025-11-04

Azure Resilience Management Drills Target Resource Contributor

82c6a823-ae9c-4b90-b5c5-bff581c45896

2025-11-04

Azure Resilience Management Goals Administrator

a2b7cc47-30ec-462f-a2f4-9ac6e1c266af

2025-10-22

Azure RBAC Built-in Roles