Azure Management and governance built-in role
Automation Contributor
Manages all Azure Automation account resources except Azure RBAC access. Its control-plane permissions also include deployments, monitoring configuration, support tickets, and Log Analytics shared-key retrieval. Permissions used by a runbook identity against target resources are separate from this human or management role.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: f353d9bd-d4a6-484e-a77a-8050b599b867
Control-plane actions (11)
Microsoft.Automation/automationAccounts/*Microsoft.Authorization/*/readMicrosoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.Support/*Microsoft.Insights/ActionGroups/*Microsoft.Insights/ActivityLogAlerts/*Microsoft.Insights/MetricAlerts/*Microsoft.Insights/ScheduledQueryRules/*Microsoft.Insights/diagnosticSettings/*Microsoft.OperationalInsights/workspaces/sharedKeys/action
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Azure RBAC assignments apply at the selected scope and are inherited by child scopes. Keep the assignment at the narrowest resource, resource group, subscription, or management-group boundary that contains the intended resources. Microsoft documents Automation account scope for managing one account. Broader scope also exposes the role's deployment, monitoring, support, and workspace-key operations across inherited resources.
Common use cases (2)
- Administer runbooks, jobs, schedules, variables, credentials, connections, modules, webhooks, and Hybrid Runbook Worker configuration in an Automation account.
- Operate deployment automation while access to target Azure or third-party resources remains assigned separately to the runbook managed identity or credential.
Prerequisites (2)
- An Automation account must exist and its runbook authentication model must be defined.
- Grant the Automation account managed identity only the target-resource roles required by each runbook.
Best practices (2)
- Assign at the Automation account and use the narrower operator roles for job-only duties.
- Use managed identities instead of Run As accounts or embedded credentials and limit each runbook identity to its required target-resource operations.
Security considerations (3)
- Automation account administration can change code and assets that execute unattended and can retrieve Automation account or Log Analytics keys exposed by the definition.
- A runbook can act only with its configured identity or credentials, but changing a trusted runbook can turn those separate permissions into code execution against target resources.
- The role is control-plane only and cannot assign Azure roles, but it is a broad privileged automation role rather than a least-privilege default.
Assignment guidance
Reserve Automation Contributor for trusted Automation platform administrators at the Automation account scope. Use Job Operator, Operator, and Runbook Operator for execution duties, and review runbook managed-identity access separately from user access to the Automation account.
Related roles (3)
- Automation Operator: Runs and schedules jobs without editing Automation assets.
- Automation Job Operator: Creates and manages jobs for all runbooks without account administration.
- Automation Runbook Operator: Combines with Job Operator to limit execution to selected runbooks.
Common questions
When should I assign the Automation Contributor Azure role?
Assign Automation Contributor when you need to: Administer runbooks, jobs, schedules, variables, credentials, connections, modules, webhooks, and Hybrid Runbook Worker configuration in an Automation account.; and Operate deployment automation while access to target Azure or third-party resources remains assigned separately to the runbook managed identity or credential.. Practical scope: Azure RBAC assignments apply at the selected scope and are inherited by child scopes. Keep the assignment at the narrowest resource, resource group, subscription, or management-group boundary that contains the intended resources. Microsoft documents Automation account scope for managing one account. Broader scope also exposes the role's deployment, monitoring, support, and workspace-key operations across inherited resources.
What permissions does the Automation Contributor Azure role grant?
The role definition grants 11 combined control-plane and data-plane actions. Representative operations include: Microsoft.Automation/automationAccounts/*; Microsoft.Authorization/*/read; Microsoft.Resources/deployments/*; Microsoft.Resources/subscriptions/resourceGroups/read; Microsoft.Support/*; and Microsoft.Insights/ActionGroups/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Automation Contributor Azure role?
Key considerations when assigning Automation Contributor: Automation account administration can change code and assets that execute unattended and can retrieve Automation account or Log Analytics keys exposed by the definition.; A runbook can act only with its configured identity or credentials, but changing a trusted runbook can turn those separate permissions into code execution against target resources.; and The role is control-plane only and cannot assign Azure roles, but it is a broad privileged automation role rather than a least-privilege default.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Management and governance →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Manage role permissions and security in Azure Automation →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Runbook execution in Azure Automation →
Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.