Azure Security built-in role

App Compliance Automation Administrator

Administers the App Compliance Automation Tool for Microsoft 365 (ACAT) and the Azure resources used by its compliance-report workflow. The built-in definition has no DataActions, but its control-plane authority includes all ACAT operations, broad read access, storage-account and blob/file service configuration, blob-container changes, storage-account key listing, user delegation key generation, resource-group changes, deployments, policy evaluation, Microsoft Defender for Cloud automation changes, and security-provider registration or unregistration.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: 0f37683f-2463-46b6-9ce7-9b788b988ba2

Control-plane actions (28)

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

ACAT evaluates the cloud resources that define an application compliance boundary, and those resources can span multiple subscriptions. Microsoft requires the administrator permissions in every corresponding subscription. An assignment at subscription scope is inherited by its resource groups and resources; do not extend it to a management group unless administration of every inheriting subscription is intended.

Common use cases (2)

Prerequisites (3)

Best practices (3)

Security considerations (4)

Assignment guidance

Assign this role only for ACAT administrator operations and only in the subscriptions represented by the application compliance report. Add the separately documented Resource Policy Contributor role, monitor account-key and user-delegation-key use plus repair actions, and use Azure Reader instead for principals that only view assessments or download reports.

Related roles (2)

Common questions

When should I assign the App Compliance Automation Administrator Azure role?

Assign App Compliance Automation Administrator when you need to: Create, modify, repair, and delete ACAT compliance reports for applications that consume Microsoft 365 customer data.; and Operate ACAT assessment refreshes and the documented self-recovery workflow across every subscription included in a report.. Practical scope: ACAT evaluates the cloud resources that define an application compliance boundary, and those resources can span multiple subscriptions. Microsoft requires the administrator permissions in every corresponding subscription. An assignment at subscription scope is inherited by its resource groups and resources; do not extend it to a management group unless administration of every inheriting subscription is intended.

What permissions does the App Compliance Automation Administrator Azure role grant?

The role definition grants 28 combined control-plane and data-plane actions. Representative operations include: Microsoft.AppComplianceAutomation/*; Microsoft.Storage/storageAccounts/blobServices/write; Microsoft.Storage/storageAccounts/fileservices/write; Microsoft.Storage/storageAccounts/listKeys/action; Microsoft.Storage/storageAccounts/write; and Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the App Compliance Automation Administrator Azure role?

Key considerations when assigning App Compliance Automation Administrator: The role can list storage-account keys. Shared Key grants full access to storage-account data and can sign service or account SAS tokens even though the role definition has no DataActions.; The role can request a user delegation key, but that key alone grants no blob data access. A resulting user delegation SAS is limited by both its encoded permissions and separate Blob Storage RBAC or POSIX ACL permissions held by the requester. SAS generation is not directly auditable.; Its wildcard control-plane read permission exposes resource configuration throughout the assigned scope.; and The definition can change storage service and container configuration, create or delete resource groups, change Microsoft Defender for Cloud automations, and register or unregister the security provider, so it is a broad privileged administrator role rather than a least-privilege reporting role.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (7)

Official Microsoft Learn documentation →