What are Azure built-in roles?

Azure built-in roles are predefined RBAC (Role-Based Access Control) roles provided by Microsoft Azure. They grant specific permissions to Azure resources and cannot be modified. Examples include Owner, Contributor, Reader, and 862+ specialized roles for services like Storage, Key Vault, and Virtual Machines.

How many Azure built-in roles are there?

There are currently 865 Azure built-in roles. This number grows as Microsoft adds new Azure services and features. This site monitors and tracks all changes to these roles.

What is the difference between Owner, Contributor, and Reader roles?

Owner has full access including the ability to assign roles to others. Contributor can create and manage all resources but cannot grant access to others. Reader can only view resources but cannot make any changes. These are the three fundamental Azure built-in roles.

How do I find the right Azure role for my needs?

Use our Role Recommender tool to find the least-privilege Azure built-in role. Enter the operations you need (like Microsoft.Storage/storageAccounts/read) and get recommendations for the most appropriate role with minimal excess permissions.

Where can I find the role definition ID for an Azure built-in role?

Each Azure built-in role has a unique GUID as its role definition ID. You can find these IDs on this site by clicking on any role to view its details. For example, the Contributor role ID is b24988ac-6180-42a0-ab88-20f7382dd24c.

What are actions, notActions, dataActions, and notDataActions in Azure RBAC?

In Azure RBAC, 'actions' define allowed control plane operations (like managing resources), while 'dataActions' define data plane operations (like reading blob data). 'notActions' and 'notDataActions' are exclusions that remove specific permissions from the allowed set. The effective permissions are: actions minus notActions, and dataActions minus notDataActions.

How often are Azure built-in roles updated by Microsoft?

Microsoft updates Azure built-in roles regularly as new Azure services and features are released. This site monitors for changes daily and shows the complete change history for each role, including what permissions were added or removed.

Can I create custom roles in Azure RBAC?

Yes, Azure allows you to create custom RBAC roles when built-in roles don't meet your needs. Custom roles let you define exact permissions by specifying actions, notActions, dataActions, and notDataActions. However, following the principle of least privilege, it's recommended to use built-in roles when possible.

Azure Built-in Roles List - RBAC Permissions Reference

Role Name	Role ID	Last Updated
Azure Edge Hardware Center Administrator	`9295f069-25d0-4f44-bb6a-3da70d11aa00`	2024-08-08
Azure Edge On-Site Deployment Engineer	`207bcc4b-86a6-4487-9141-d6c1f4c238aa`	2024-09-03
Azure Event Hubs Data Owner	`f526a384-b230-433a-b45c-95f59c4a2dec`	2021-11-11
Azure Event Hubs Data Receiver	`a638d3c7-ab3a-418d-83e6-5f17a39d4fde`	2021-11-11
Azure Event Hubs Data Sender	`2b629674-e913-4c01-ae53-ef4638d8f975`	2021-11-11
Azure Extension for SQL Server Deployment	`7392c568-9289-4bde-aaaa-b7131215889d`	2023-03-17
Azure File Sync Administrator	`92b92042-07d9-4307-87f7-36a593fc5850`	2025-11-12
Azure File Sync Reader	`754c1a27-40dc-4708-8ad4-2bffdeee09e8`	2025-03-31
Azure Front Door Domain Contributor	`0ab34830-df19-4f8c-b84e-aa85b8afa6e8`	2023-12-11
Azure Front Door Domain Reader	`0f99d363-226e-4dca-9920-b807cf8e1a5f`	2023-12-11
Azure Front Door Profile Reader	`662802e2-50f6-46b0-aed2-e834bacc6d12`	2024-01-30
Azure Front Door Secret Contributor	`3f2eb865-5811-4578-b90a-6fc6fa0df8e5`	2023-12-11
Azure Front Door Secret Reader	`0db238c4-885e-4c4f-a933-aa2cef684fca`	2023-12-11
Azure Hybrid Database Administrator - Read Only Service Role	`5d9c6a55-fc0e-4e21-ae6f-f7b095497342`	2024-04-05
Azure impact-insight reader	`dfb2f09d-25f8-4558-8986-497084006d7a`	2024-01-23
Azure impact Reporter role	`36e80216-a7e8-4f42-a7e1-f12c98cbaf8a`	2025-09-30
Azure IoT Operations Administrator	`5bc02df6-6cd5-43fe-ad3d-4c93cf56cc16`	2025-07-17
Azure IoT Operations Onboarding	`7b7c71ed-33fa-4ed2-a91a-e56d5da260b5`	2025-07-17
Azure Kubernetes Fleet Manager Contributor Role	`63bb64ad-9799-4770-b5c3-24ed299a07bf`	2024-03-29
Azure Kubernetes Fleet Manager Hub Agent Role	`de2b316d-7a2c-4143-b4cd-c148f6a355a1`	2025-05-27
Azure Kubernetes Fleet Manager Hub Cluster User Role	`850c5848-fc51-4a9a-8823-f220370626e3`	2025-09-15
Azure Kubernetes Fleet Manager RBAC Admin	`434fb43a-c01c-447e-9f67-c3ad923cfaba`	2024-10-23
Azure Kubernetes Fleet Manager RBAC Admin for Member Clusters	`d1f699ed-700a-4c77-a22f-29890ac7b115`	2025-10-24
Azure Kubernetes Fleet Manager RBAC Cluster Admin	`18ab4d3d-a1bf-4477-8ad9-8359bc988f69`	2025-11-17
Azure Kubernetes Fleet Manager RBAC Cluster Admin for Member Clusters	`79a36d98-eb96-4a76-ae1d-481dc98d2c23`	2025-10-24

Azure Edge Hardware Center Administrator

9295f069-25d0-4f44-bb6a-3da70d11aa00

2024-08-08

Azure Edge On-Site Deployment Engineer

207bcc4b-86a6-4487-9141-d6c1f4c238aa

2024-09-03

Azure Event Hubs Data Owner

f526a384-b230-433a-b45c-95f59c4a2dec

2021-11-11

Azure Event Hubs Data Receiver

a638d3c7-ab3a-418d-83e6-5f17a39d4fde

2021-11-11

Azure Event Hubs Data Sender

2b629674-e913-4c01-ae53-ef4638d8f975

2021-11-11

Azure Extension for SQL Server Deployment

7392c568-9289-4bde-aaaa-b7131215889d

2023-03-17

Azure File Sync Administrator

92b92042-07d9-4307-87f7-36a593fc5850

2025-11-12

Azure File Sync Reader

754c1a27-40dc-4708-8ad4-2bffdeee09e8

2025-03-31

Azure Front Door Domain Contributor

0ab34830-df19-4f8c-b84e-aa85b8afa6e8

2023-12-11

Azure Front Door Domain Reader

0f99d363-226e-4dca-9920-b807cf8e1a5f

2023-12-11

Azure Front Door Profile Reader

662802e2-50f6-46b0-aed2-e834bacc6d12

2024-01-30

Azure Front Door Secret Contributor

3f2eb865-5811-4578-b90a-6fc6fa0df8e5

2023-12-11

Azure Front Door Secret Reader

0db238c4-885e-4c4f-a933-aa2cef684fca

2023-12-11

Azure Hybrid Database Administrator - Read Only Service Role

5d9c6a55-fc0e-4e21-ae6f-f7b095497342

2024-04-05

Azure impact-insight reader

dfb2f09d-25f8-4558-8986-497084006d7a

2024-01-23

Azure impact Reporter role

36e80216-a7e8-4f42-a7e1-f12c98cbaf8a

2025-09-30

Azure IoT Operations Administrator

5bc02df6-6cd5-43fe-ad3d-4c93cf56cc16

2025-07-17

Azure IoT Operations Onboarding

7b7c71ed-33fa-4ed2-a91a-e56d5da260b5

2025-07-17

Azure Kubernetes Fleet Manager Contributor Role

63bb64ad-9799-4770-b5c3-24ed299a07bf

2024-03-29

Azure Kubernetes Fleet Manager Hub Agent Role

de2b316d-7a2c-4143-b4cd-c148f6a355a1

2025-05-27

Azure Kubernetes Fleet Manager Hub Cluster User Role

850c5848-fc51-4a9a-8823-f220370626e3

2025-09-15

Azure Kubernetes Fleet Manager RBAC Admin

434fb43a-c01c-447e-9f67-c3ad923cfaba

2024-10-23

Azure Kubernetes Fleet Manager RBAC Admin for Member Clusters

d1f699ed-700a-4c77-a22f-29890ac7b115

2025-10-24

Azure Kubernetes Fleet Manager RBAC Cluster Admin

18ab4d3d-a1bf-4477-8ad9-8359bc988f69

2025-11-17

Azure Kubernetes Fleet Manager RBAC Cluster Admin for Member Clusters

79a36d98-eb96-4a76-ae1d-481dc98d2c23

2025-10-24