Azure Management and governance built-in role

Automation Contributor

Manages all Azure Automation account resources except Azure RBAC access. Its control-plane permissions also include deployments, monitoring configuration, support tickets, and Log Analytics shared-key retrieval. Permissions used by a runbook identity against target resources are separate from this human or management role.

Control-plane actions (11)

• Microsoft.Automation/automationAccounts/*
• Microsoft.Authorization/*/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Support/*
• Microsoft.Insights/ActionGroups/*
• Microsoft.Insights/ActivityLogAlerts/*
• Microsoft.Insights/MetricAlerts/*
• Microsoft.Insights/ScheduledQueryRules/*
• Microsoft.Insights/diagnosticSettings/*
• Microsoft.OperationalInsights/workspaces/sharedKeys/action

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Azure RBAC assignments apply at the selected scope and are inherited by child scopes. Keep the assignment at the narrowest resource, resource group, subscription, or management-group boundary that contains the intended resources. Microsoft documents Automation account scope for managing one account. Broader scope also exposes the role's deployment, monitoring, support, and workspace-key operations across inherited resources.

Common use cases (2)

• Administer runbooks, jobs, schedules, variables, credentials, connections, modules, webhooks, and Hybrid Runbook Worker configuration in an Automation account.
• Operate deployment automation while access to target Azure or third-party resources remains assigned separately to the runbook managed identity or credential.

Prerequisites (2)

• An Automation account must exist and its runbook authentication model must be defined.
• Grant the Automation account managed identity only the target-resource roles required by each runbook.

Best practices (2)

• Assign at the Automation account and use the narrower operator roles for job-only duties.
• Use managed identities instead of Run As accounts or embedded credentials and limit each runbook identity to its required target-resource operations.

Security considerations (3)

• Automation account administration can change code and assets that execute unattended and can retrieve Automation account or Log Analytics keys exposed by the definition.
• A runbook can act only with its configured identity or credentials, but changing a trusted runbook can turn those separate permissions into code execution against target resources.
• The role is control-plane only and cannot assign Azure roles, but it is a broad privileged automation role rather than a least-privilege default.

Assignment guidance

Reserve Automation Contributor for trusted Automation platform administrators at the Automation account scope. Use Job Operator, Operator, and Runbook Operator for execution duties, and review runbook managed-identity access separately from user access to the Automation account.

Related roles (3)

• Automation Operator: Runs and schedules jobs without editing Automation assets.
• Automation Job Operator: Creates and manages jobs for all runbooks without account administration.
• Automation Runbook Operator: Combines with Job Operator to limit execution to selected runbooks.

Editorial sources (6)

• Azure built-in roles for Management and governance →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Manage role permissions and security in Azure Automation →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Runbook execution in Azure Automation →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →