Azure Management and governance built-in role
Advisor Reviews Contributor
Reads Azure Advisor resiliency reviews and linked triage resources and can approve, reject, or reset triage recommendations. It also includes deployment and classic alert-rule management in the control plane and has no DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 8aac15f0-d885-4138-8afa-bfb5872f7d13
Control-plane actions (10)
Microsoft.Advisor/resiliencyReviews/readMicrosoft.Advisor/triageRecommendations/readMicrosoft.Advisor/triageRecommendations/approve/actionMicrosoft.Advisor/triageRecommendations/reject/actionMicrosoft.Advisor/triageRecommendations/reset/actionMicrosoft.Advisor/triageResources/readMicrosoft.Authorization/*/readMicrosoft.Insights/alertRules/*Microsoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Azure RBAC assignments apply at the selected scope and are inherited by child scopes. Keep the assignment at the narrowest resource, resource group, subscription, or management-group boundary that contains the intended resources. Assign at the workload, resource-group, or subscription boundary covered by the resiliency review; deployment and classic alert permissions apply throughout that same scope.
Common use cases (2)
- Review workload resiliency findings and approve, reject, or reset linked triage recommendations.
- Coordinate review outcomes while retaining visibility into the resources included in a resiliency review.
Prerequisites (2)
- A resiliency review and its workload resources must exist in Azure Advisor.
- The reviewer must be authorized to make governance decisions on the recommendations, not merely observe them.
Best practices (2)
- Use Advisor Reviews Reader when no triage decision is required.
- Keep the assignment near the reviewed workload and account for the role's deployment and classic alert-rule actions during approval.
Security considerations (2)
- Approving or rejecting recommendations changes the recorded resiliency review outcome.
- The role has no DataActions, but its deployment and classic alert-rule actions make it broader than review triage alone.
Assignment guidance
Assign to workload owners or architecture reviewers who are authorized to decide resiliency review outcomes. Prefer the Reader counterpart for auditors, and explicitly approve the ancillary deployment and alert permissions at the selected scope.
Related roles (1)
- Advisor Reviews Reader: Read-only counterpart for resiliency reviews and linked recommendations without approve, reject, or reset actions.
Common questions
When should I assign the Advisor Reviews Contributor Azure role?
Assign Advisor Reviews Contributor when you need to: Review workload resiliency findings and approve, reject, or reset linked triage recommendations.; and Coordinate review outcomes while retaining visibility into the resources included in a resiliency review.. Practical scope: Azure RBAC assignments apply at the selected scope and are inherited by child scopes. Keep the assignment at the narrowest resource, resource group, subscription, or management-group boundary that contains the intended resources. Assign at the workload, resource-group, or subscription boundary covered by the resiliency review; deployment and classic alert permissions apply throughout that same scope.
What permissions does the Advisor Reviews Contributor Azure role grant?
The role definition grants 10 combined control-plane and data-plane actions. Representative operations include: Microsoft.Advisor/resiliencyReviews/read; Microsoft.Advisor/triageRecommendations/read; Microsoft.Advisor/triageRecommendations/approve/action; Microsoft.Advisor/triageRecommendations/reject/action; Microsoft.Advisor/triageRecommendations/reset/action; and Microsoft.Advisor/triageResources/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Advisor Reviews Contributor Azure role?
Key considerations when assigning Advisor Reviews Contributor: Approving or rejecting recommendations changes the recorded resiliency review outcome.; and The role has no DataActions, but its deployment and classic alert-rule actions make it broader than review triage alone.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Management and governance →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Azure Advisor Resiliency Reviews →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Roles and permissions in Azure Advisor →
Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.