What are Azure built-in roles?

Azure built-in roles are predefined RBAC (Role-Based Access Control) roles provided by Microsoft Azure. They grant specific permissions to Azure resources and cannot be modified. Examples include Owner, Contributor, Reader, and 862+ specialized roles for services like Storage, Key Vault, and Virtual Machines.

How many Azure built-in roles are there?

There are currently 865 Azure built-in roles. This number grows as Microsoft adds new Azure services and features. This site monitors and tracks all changes to these roles.

What is the difference between Owner, Contributor, and Reader roles?

Owner has full access including the ability to assign roles to others. Contributor can create and manage all resources but cannot grant access to others. Reader can only view resources but cannot make any changes. These are the three fundamental Azure built-in roles.

How do I find the right Azure role for my needs?

Use our Role Recommender tool to find the least-privilege Azure built-in role. Enter the operations you need (like Microsoft.Storage/storageAccounts/read) and get recommendations for the most appropriate role with minimal excess permissions.

Where can I find the role definition ID for an Azure built-in role?

Each Azure built-in role has a unique GUID as its role definition ID. You can find these IDs on this site by clicking on any role to view its details. For example, the Contributor role ID is b24988ac-6180-42a0-ab88-20f7382dd24c.

What are actions, notActions, dataActions, and notDataActions in Azure RBAC?

In Azure RBAC, 'actions' define allowed control plane operations (like managing resources), while 'dataActions' define data plane operations (like reading blob data). 'notActions' and 'notDataActions' are exclusions that remove specific permissions from the allowed set. The effective permissions are: actions minus notActions, and dataActions minus notDataActions.

How often are Azure built-in roles updated by Microsoft?

Microsoft updates Azure built-in roles regularly as new Azure services and features are released. This site monitors for changes daily and shows the complete change history for each role, including what permissions were added or removed.

Can I create custom roles in Azure RBAC?

Yes, Azure allows you to create custom RBAC roles when built-in roles don't meet your needs. Custom roles let you define exact permissions by specifying actions, notActions, dataActions, and notDataActions. However, following the principle of least privilege, it's recommended to use built-in roles when possible.

Azure Built-in Roles List - RBAC Permissions Reference

Role Name	Role ID	Last Updated
Access Review Operator Service Role	`76cc9ee4-d5d3-4a45-a930-26add3d73475`	2022-07-04
AcrDelete	`c2f4ef07-c644-48eb-af81-4b1b4947fb11`	2021-11-11
AcrImageSigner	`6cef56e8-d556-48e5-a04f-b8e64114680f`	2025-10-07
AcrPull	`7f951dda-4ed3-4680-a7ca-43fe172d538d`	2021-11-11
AcrPush	`8311e382-0749-4cb8-b61a-304f252e45ec`	2021-11-11
AcrQuarantineReader	`cdda3590-29a3-44f6-95f2-9f980659eb04`	2021-11-11
AcrQuarantineWriter	`c8d4ff99-41c3-41a8-9f60-21dfdad59608`	2021-11-11
Advisor Recommendations Contributor (Assessments and Reviews)	`6b534d80-e337-47c4-864f-140f5c7f593d`	2024-03-18
Advisor Reviews Contributor	`8aac15f0-d885-4138-8afa-bfb5872f7d13`	2025-04-04
Advisor Reviews Reader	`c64499e0-74c3-47ad-921c-13865957895c`	2025-04-04
AgFood Platform Dataset Admin	`a8d4b70f-0fb9-4f72-b267-b87b2f990aec`	2023-11-08
AgFood Platform Sensor Partner Contributor	`6b77f0a0-0d89-41cc-acd1-579c22c17a67`	2022-10-27
AgFood Platform Service Admin	`f8da80de-1ff9-4747-ad80-a19b7f6079e3`	2021-11-11
AgFood Platform Service Contributor	`8508508a-4469-4e45-963b-2518ee0bb728`	2023-12-05
AgFood Platform Service Reader	`7ec7ccdc-f61e-41fe-9aaf-980df0a44eba`	2022-12-13
AI Model Scanner Operator	`8b9beb50-e28c-4879-8472-24c9d328085f`	2025-08-06
AnyBuild Builder	`a2138dac-4907-4679-a376-736901ed8ad8`	2021-11-11
API Management Developer Portal Content Editor	`c031e6a8-4391-4de0-8d69-4706a7ed3729`	2022-05-10
API Management Service Contributor	`312a565d-c81f-4fd8-895a-4e21e48d571c`	2021-11-11
API Management Service Operator Role	`e022efe7-f5ba-4159-bbe4-b44f577e9b61`	2021-11-11
API Management Service Reader Role	`71522526-b88f-4d52-b57f-d31fc3546d0d`	2021-11-11
API Management Service Workspace API Developer	`9565a273-41b9-4368-97d2-aeb0c976a9b3`	2024-09-02
API Management Service Workspace API Product Manager	`d59a3e9c-6d52-4a5a-aeed-6bf3cf0e31da`	2024-09-02
API Management Workspace API Developer	`56328988-075d-4c6a-8766-d93edd6725b6`	2025-05-16
API Management Workspace API Product Manager	`73c2c328-d004-4c5e-938c-35c6f5679a1f`	2025-05-16

Access Review Operator Service Role

76cc9ee4-d5d3-4a45-a930-26add3d73475

2022-07-04

AcrDelete

c2f4ef07-c644-48eb-af81-4b1b4947fb11

2021-11-11

AcrImageSigner

6cef56e8-d556-48e5-a04f-b8e64114680f

2025-10-07

AcrPull

7f951dda-4ed3-4680-a7ca-43fe172d538d

2021-11-11

AcrPush

8311e382-0749-4cb8-b61a-304f252e45ec

2021-11-11

AcrQuarantineReader

cdda3590-29a3-44f6-95f2-9f980659eb04

2021-11-11

AcrQuarantineWriter

c8d4ff99-41c3-41a8-9f60-21dfdad59608

2021-11-11

Advisor Recommendations Contributor (Assessments and Reviews)

6b534d80-e337-47c4-864f-140f5c7f593d

2024-03-18

Advisor Reviews Contributor

8aac15f0-d885-4138-8afa-bfb5872f7d13

2025-04-04

Advisor Reviews Reader

c64499e0-74c3-47ad-921c-13865957895c

2025-04-04

AgFood Platform Dataset Admin

a8d4b70f-0fb9-4f72-b267-b87b2f990aec

2023-11-08

AgFood Platform Sensor Partner Contributor

6b77f0a0-0d89-41cc-acd1-579c22c17a67

2022-10-27

AgFood Platform Service Admin

f8da80de-1ff9-4747-ad80-a19b7f6079e3

2021-11-11

AgFood Platform Service Contributor

8508508a-4469-4e45-963b-2518ee0bb728

2023-12-05

AgFood Platform Service Reader

7ec7ccdc-f61e-41fe-9aaf-980df0a44eba

2022-12-13

AI Model Scanner Operator

8b9beb50-e28c-4879-8472-24c9d328085f

2025-08-06

AnyBuild Builder

a2138dac-4907-4679-a376-736901ed8ad8

2021-11-11

API Management Developer Portal Content Editor

c031e6a8-4391-4de0-8d69-4706a7ed3729

2022-05-10

API Management Service Contributor

312a565d-c81f-4fd8-895a-4e21e48d571c

2021-11-11

API Management Service Operator Role

e022efe7-f5ba-4159-bbe4-b44f577e9b61

2021-11-11

API Management Service Reader Role

71522526-b88f-4d52-b57f-d31fc3546d0d

2021-11-11

API Management Service Workspace API Developer

9565a273-41b9-4368-97d2-aeb0c976a9b3

2024-09-02

API Management Service Workspace API Product Manager

d59a3e9c-6d52-4a5a-aeed-6bf3cf0e31da

2024-09-02

API Management Workspace API Developer

56328988-075d-4c6a-8766-d93edd6725b6

2025-05-16

API Management Workspace API Product Manager

73c2c328-d004-4c5e-938c-35c6f5679a1f

2025-05-16