What are Azure built-in roles?

Azure built-in roles are predefined RBAC (Role-Based Access Control) roles provided by Microsoft Azure. They grant specific permissions to Azure resources and cannot be modified. Examples include Owner, Contributor, Reader, and 862+ specialized roles for services like Storage, Key Vault, and Virtual Machines.

How many Azure built-in roles are there?

There are currently 865 Azure built-in roles. This number grows as Microsoft adds new Azure services and features. This site monitors and tracks all changes to these roles.

What is the difference between Owner, Contributor, and Reader roles?

Owner has full access including the ability to assign roles to others. Contributor can create and manage all resources but cannot grant access to others. Reader can only view resources but cannot make any changes. These are the three fundamental Azure built-in roles.

How do I find the right Azure role for my needs?

Use our Role Recommender tool to find the least-privilege Azure built-in role. Enter the operations you need (like Microsoft.Storage/storageAccounts/read) and get recommendations for the most appropriate role with minimal excess permissions.

Where can I find the role definition ID for an Azure built-in role?

Each Azure built-in role has a unique GUID as its role definition ID. You can find these IDs on this site by clicking on any role to view its details. For example, the Contributor role ID is b24988ac-6180-42a0-ab88-20f7382dd24c.

What are actions, notActions, dataActions, and notDataActions in Azure RBAC?

In Azure RBAC, 'actions' define allowed control plane operations (like managing resources), while 'dataActions' define data plane operations (like reading blob data). 'notActions' and 'notDataActions' are exclusions that remove specific permissions from the allowed set. The effective permissions are: actions minus notActions, and dataActions minus notDataActions.

How often are Azure built-in roles updated by Microsoft?

Microsoft updates Azure built-in roles regularly as new Azure services and features are released. This site monitors for changes daily and shows the complete change history for each role, including what permissions were added or removed.

Can I create custom roles in Azure RBAC?

Yes, Azure allows you to create custom RBAC roles when built-in roles don't meet your needs. Custom roles let you define exact permissions by specifying actions, notActions, dataActions, and notDataActions. However, following the principle of least privilege, it's recommended to use built-in roles when possible.

Azure Built-in Roles List - RBAC Permissions Reference

Role Name	Role ID	Last Updated
Autonomous Development Platform Data Owner (Preview)	`27f8b550-c507-4db9-86f2-f4b8e816d59d`	2022-01-04
Autonomous Development Platform Data Reader (Preview)	`d63b75f7-47ea-4f27-92ac-e0d173aaf093`	2022-01-04
Avere Contributor	`4f8fab4f-1852-4a58-a46a-8eaf358af14a`	2021-11-11
Avere Operator	`c025889f-8102-4ebf-b32c-fc0c6f0c6bd9`	2021-11-11
AVS on Fleet VIS Role	`49fc33c1-886f-4b21-a00e-1d9993234734`	2025-06-13
AVS Orchestrator Role	`d715fb95-a0f0-4f1c-8be6-5ad2d2767f67`	2025-02-17
Aws Connector contributor role	`98c206fe-ea1b-4578-93f8-83a99a5628fc`	2025-09-10
Azure Advisor Service Role	`69a41f41-6dce-4ea7-8a34-8e095ddba55c`	2025-07-23
Azure AI Account Owner	`e47c6f54-e4a2-4754-9501-8e0985b135e1`	2025-05-05
Azure AI Administrator	`b78c5d69-af96-48a3-bf8d-a8b4d589de94`	2025-04-17
Azure AI Developer	`64702f94-c441-49e6-a78b-ef80e0188fee`	2025-04-21
Azure AI Enterprise Network Connection Approver	`b556d68e-0be0-4f35-a333-ad7ee1ce17ea`	2025-01-31
Azure AI Enterprise Networking Outbound Rules Operator	`25cabde7-1a6c-4350-8877-cb6fe59f1399`	2025-08-06
Azure AI Inference Deployment Operator	`3afb7f49-54cb-416e-8c09-6dc049efa503`	2024-03-19
Azure AI Owner	`c883944f-8b7b-4483-af10-35834be79c4a`	2025-12-18
Azure AI Project Manager	`eadc314b-1a2d-4efa-be10-5d325db5065e`	2025-05-05
Azure AI Safety Evaluator	`11102f94-c441-49e6-a78b-ef80e0188abc`	2024-12-19
Azure AI User	`53ca6127-db72-4b80-b1b0-d745d6d5456d`	2025-12-10
Azure API Center Compliance Manager	`ede9aaa3-4627-494e-be13-4aa7c256148d`	2024-03-26
Azure API Center Credential Access Reader	`1df7cd83-1d3f-41df-95b0-53b30d963369`	2025-03-24
Azure API Center Data Reader	`c7244dfb-f447-457d-b2ba-3999044d1706`	2025-04-24
Azure API Center Service Contributor	`dd24193f-ef65-44e5-8a7e-6fa6e03f7713`	2025-07-01
Azure API Center Service Reader	`6cba8790-29c5-48e5-bab1-c7541b01cb04`	2024-03-26
Azure Arc Enabled Kubernetes Cluster User Role	`00493d72-78f6-4148-b6c5-d3ce8e4799dd`	2022-02-17
Azure Arc Kubernetes Admin	`dffb1e0c-446f-4dde-a09f-99eb5cc68b96`	2021-11-11

Autonomous Development Platform Data Owner (Preview)

27f8b550-c507-4db9-86f2-f4b8e816d59d

2022-01-04

Autonomous Development Platform Data Reader (Preview)

d63b75f7-47ea-4f27-92ac-e0d173aaf093

2022-01-04

Avere Contributor

4f8fab4f-1852-4a58-a46a-8eaf358af14a

2021-11-11

Avere Operator

c025889f-8102-4ebf-b32c-fc0c6f0c6bd9

2021-11-11

AVS on Fleet VIS Role

49fc33c1-886f-4b21-a00e-1d9993234734

2025-06-13

AVS Orchestrator Role

d715fb95-a0f0-4f1c-8be6-5ad2d2767f67

2025-02-17

Aws Connector contributor role

98c206fe-ea1b-4578-93f8-83a99a5628fc

2025-09-10

Azure Advisor Service Role

69a41f41-6dce-4ea7-8a34-8e095ddba55c

2025-07-23

Azure AI Account Owner

e47c6f54-e4a2-4754-9501-8e0985b135e1

2025-05-05

Azure AI Administrator

b78c5d69-af96-48a3-bf8d-a8b4d589de94

2025-04-17

Azure AI Developer

64702f94-c441-49e6-a78b-ef80e0188fee

2025-04-21

Azure AI Enterprise Network Connection Approver

b556d68e-0be0-4f35-a333-ad7ee1ce17ea

2025-01-31

Azure AI Enterprise Networking Outbound Rules Operator

25cabde7-1a6c-4350-8877-cb6fe59f1399

2025-08-06

Azure AI Inference Deployment Operator

3afb7f49-54cb-416e-8c09-6dc049efa503

2024-03-19

Azure AI Owner

c883944f-8b7b-4483-af10-35834be79c4a

2025-12-18

Azure AI Project Manager

eadc314b-1a2d-4efa-be10-5d325db5065e

2025-05-05

Azure AI Safety Evaluator

11102f94-c441-49e6-a78b-ef80e0188abc

2024-12-19

Azure AI User

53ca6127-db72-4b80-b1b0-d745d6d5456d

2025-12-10

Azure API Center Compliance Manager

ede9aaa3-4627-494e-be13-4aa7c256148d

2024-03-26

Azure API Center Credential Access Reader

1df7cd83-1d3f-41df-95b0-53b30d963369

2025-03-24

Azure API Center Data Reader

c7244dfb-f447-457d-b2ba-3999044d1706

2025-04-24

Azure API Center Service Contributor

dd24193f-ef65-44e5-8a7e-6fa6e03f7713

2025-07-01

Azure API Center Service Reader

6cba8790-29c5-48e5-bab1-c7541b01cb04

2024-03-26

Azure Arc Enabled Kubernetes Cluster User Role

00493d72-78f6-4148-b6c5-d3ce8e4799dd

2022-02-17

Azure Arc Kubernetes Admin

dffb1e0c-446f-4dde-a09f-99eb5cc68b96

2021-11-11