What are Azure built-in roles?

Azure built-in roles are predefined RBAC (Role-Based Access Control) roles provided by Microsoft Azure. They grant specific permissions to Azure resources and cannot be modified. Examples include Owner, Contributor, Reader, and 862+ specialized roles for services like Storage, Key Vault, and Virtual Machines.

How many Azure built-in roles are there?

There are currently 865 Azure built-in roles. This number grows as Microsoft adds new Azure services and features. This site monitors and tracks all changes to these roles.

What is the difference between Owner, Contributor, and Reader roles?

Owner has full access including the ability to assign roles to others. Contributor can create and manage all resources but cannot grant access to others. Reader can only view resources but cannot make any changes. These are the three fundamental Azure built-in roles.

How do I find the right Azure role for my needs?

Use our Role Recommender tool to find the least-privilege Azure built-in role. Enter the operations you need (like Microsoft.Storage/storageAccounts/read) and get recommendations for the most appropriate role with minimal excess permissions.

Where can I find the role definition ID for an Azure built-in role?

Each Azure built-in role has a unique GUID as its role definition ID. You can find these IDs on this site by clicking on any role to view its details. For example, the Contributor role ID is b24988ac-6180-42a0-ab88-20f7382dd24c.

What are actions, notActions, dataActions, and notDataActions in Azure RBAC?

In Azure RBAC, 'actions' define allowed control plane operations (like managing resources), while 'dataActions' define data plane operations (like reading blob data). 'notActions' and 'notDataActions' are exclusions that remove specific permissions from the allowed set. The effective permissions are: actions minus notActions, and dataActions minus notDataActions.

How often are Azure built-in roles updated by Microsoft?

Microsoft updates Azure built-in roles regularly as new Azure services and features are released. This site monitors for changes daily and shows the complete change history for each role, including what permissions were added or removed.

Can I create custom roles in Azure RBAC?

Yes, Azure allows you to create custom RBAC roles when built-in roles don't meet your needs. Custom roles let you define exact permissions by specifying actions, notActions, dataActions, and notDataActions. However, following the principle of least privilege, it's recommended to use built-in roles when possible.

Azure Built-in Roles List - RBAC Permissions Reference

Role Name	Role ID	Last Updated
Azure Center for SAP solutions Service role for management	`0105a6b0-4bb9-43d2-982a-12806f9faddb`	2023-02-03
Azure Connected Machine Onboarding	`b64e21ea-ac4e-4cdf-9dc9-5b892992bee7`	2025-04-29
Azure Connected Machine Resource Administrator	`cd570a14-e51a-42ad-bac8-bafd67325302`	2025-02-04
Azure Connected Machine Resource Manager	`f5819b54-e033-4d82-ac66-4fec3cbf3f4c`	2024-08-28
Azure Connected SQL Server Onboarding	`e8113dce-c529-4d33-91fa-e9b972617508`	2021-11-11
Azure ContainerApps Session Executor	`0fb8eba5-a2bb-4abe-b1c1-49dfad359bb0`	2025-10-27
Azure Container Instances Contributor Role	`5d977122-f97e-4b4d-a52f-6b43003ddb4d`	2024-07-12
Azure Container Registry secure supply chain operator service role	`96062cf7-95ca-4f89-9b9d-2a2aa47356af`	2024-06-14
Azure Container Storage Contributor	`95dd08a6-00bd-4661-84bf-f6726f83a4d0`	2024-04-01
Azure Container Storage Operator	`08d4c71a-cc63-4ce4-a9c8-5dd251b4d619`	2024-03-25
Azure Container Storage Owner	`95de85bd-744d-4664-9dde-11430bc34793`	2024-04-01
Azure Copilot User	`6cd4ddd5-44f4-45bf-853e-a23e79738ce8`	2025-10-27
Azure Customer Lockbox Approver for Subscription	`4dae6930-7baf-46f5-909e-0383bc931c46`	2024-08-12
Azure Databases ARM Management Contributor	`b7ef99e8-10af-4a7c-8b15-5b6c352a8378`	2025-10-01
Azure Data Transfer Owner	`eded264d-1796-4e25-8500-a78427f8a316`	2025-07-29
Azure Deployment Stack Contributor	`bf7f8882-3383-422a-806a-6526c631a88a`	2025-06-09
Azure Deployment Stack Owner	`adb29209-aa1d-457b-a786-c913953d2891`	2024-05-20
Azure Device Onboarding Contributor	`a954a0e0-f57f-4606-8421-fd7bd4e54b0f`	2025-12-10
Azure Device Onboarding Discovery Contributor	`a227fb39-f479-404b-96fd-0176f5d88ab4`	2025-02-24
Azure Device Registry Contributor	`a5c3590a-3a1a-4cd4-9648-ea0a32b15137`	2025-10-27
Azure Device Registry Credentials Contributor	`09267e11-2e06-40b5-8fe4-68cea20794c9`	2025-10-20
Azure Device Registry Onboarding	`547f7f0a-69c0-4807-bd9e-0321dfb66a84`	2025-10-27
Azure Device Update Agent	`2a740172-0fc2-4039-972c-b31864cd47d6`	2024-09-03
Azure Digital Twins Data Owner	`bcd981a7-7f74-457b-83e1-cceb9e632ffe`	2022-09-07
Azure Digital Twins Data Reader	`d57506d4-4c8d-48b1-8587-93c323f6a5a3`	2024-01-12

Azure Center for SAP solutions Service role for management

0105a6b0-4bb9-43d2-982a-12806f9faddb

2023-02-03

Azure Connected Machine Onboarding

b64e21ea-ac4e-4cdf-9dc9-5b892992bee7

2025-04-29

Azure Connected Machine Resource Administrator

cd570a14-e51a-42ad-bac8-bafd67325302

2025-02-04

Azure Connected Machine Resource Manager

f5819b54-e033-4d82-ac66-4fec3cbf3f4c

2024-08-28

Azure Connected SQL Server Onboarding

e8113dce-c529-4d33-91fa-e9b972617508

2021-11-11

Azure ContainerApps Session Executor

0fb8eba5-a2bb-4abe-b1c1-49dfad359bb0

2025-10-27

Azure Container Instances Contributor Role

5d977122-f97e-4b4d-a52f-6b43003ddb4d

2024-07-12

Azure Container Registry secure supply chain operator service role

96062cf7-95ca-4f89-9b9d-2a2aa47356af

2024-06-14

Azure Container Storage Contributor

95dd08a6-00bd-4661-84bf-f6726f83a4d0

2024-04-01

Azure Container Storage Operator

08d4c71a-cc63-4ce4-a9c8-5dd251b4d619

2024-03-25

Azure Container Storage Owner

95de85bd-744d-4664-9dde-11430bc34793

2024-04-01

Azure Copilot User

6cd4ddd5-44f4-45bf-853e-a23e79738ce8

2025-10-27

Azure Customer Lockbox Approver for Subscription

4dae6930-7baf-46f5-909e-0383bc931c46

2024-08-12

Azure Databases ARM Management Contributor

b7ef99e8-10af-4a7c-8b15-5b6c352a8378

2025-10-01

Azure Data Transfer Owner

eded264d-1796-4e25-8500-a78427f8a316

2025-07-29

Azure Deployment Stack Contributor

bf7f8882-3383-422a-806a-6526c631a88a

2025-06-09

Azure Deployment Stack Owner

adb29209-aa1d-457b-a786-c913953d2891

2024-05-20

Azure Device Onboarding Contributor

a954a0e0-f57f-4606-8421-fd7bd4e54b0f

2025-12-10

Azure Device Onboarding Discovery Contributor

a227fb39-f479-404b-96fd-0176f5d88ab4

2025-02-24

Azure Device Registry Contributor

a5c3590a-3a1a-4cd4-9648-ea0a32b15137

2025-10-27

Azure Device Registry Credentials Contributor

09267e11-2e06-40b5-8fe4-68cea20794c9

2025-10-20

Azure Device Registry Onboarding

547f7f0a-69c0-4807-bd9e-0321dfb66a84

2025-10-27

Azure Device Update Agent

2a740172-0fc2-4039-972c-b31864cd47d6

2024-09-03

Azure Digital Twins Data Owner

bcd981a7-7f74-457b-83e1-cceb9e632ffe

2022-09-07

Azure Digital Twins Data Reader

d57506d4-4c8d-48b1-8587-93c323f6a5a3

2024-01-12