Azure Management and governance built-in role
Automation Job Operator
Creates and manages jobs for every runbook in an Automation account and can read job streams and output. Microsoft documents assignment at the Automation account scope; resource-group read access is also needed to start runbooks. It does not edit runbook definitions or other Automation assets.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 4fe576fe-1146-4730-92eb-48519fa6bf9f
Control-plane actions (13)
Microsoft.Authorization/*/readMicrosoft.Automation/automationAccounts/hybridRunbookWorkerGroups/readMicrosoft.Automation/automationAccounts/jobs/readMicrosoft.Automation/automationAccounts/jobs/resume/actionMicrosoft.Automation/automationAccounts/jobs/stop/actionMicrosoft.Automation/automationAccounts/jobs/streams/readMicrosoft.Automation/automationAccounts/jobs/suspend/actionMicrosoft.Automation/automationAccounts/jobs/writeMicrosoft.Automation/automationAccounts/jobs/output/readMicrosoft.Insights/alertRules/*Microsoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.Support/*
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign at the Automation account. When paired with resource-group read access, the operator can start any runbook in that account; combine with Automation Runbook Operator at individual runbook scope when only selected runbooks should execute.
Common use cases (2)
- Submit, stop, suspend, resume, and inspect jobs and outputs for all runbooks in an Automation account.
- Operate production runbooks while protecting their definitions and stored Automation assets from modification.
Prerequisites (2)
- The runbooks and their execution identities or credentials must already be configured.
- Grant read access on the resource group containing the Automation account when the operator must start runbooks.
Best practices (2)
- Use the Runbook Operator combination when execution must be restricted to named runbooks.
- Treat job output as potentially sensitive and enforce Hybrid Runbook Worker targeting where organizational policy requires it.
Security considerations (3)
- Starting a runbook can cause any action available to that runbook's managed identity or stored credentials.
- Job streams and output can disclose operational data or secrets written by runbook code.
- The role does not edit runbooks, but execution of trusted privileged automation remains security-sensitive.
Assignment guidance
Assign at the Automation account to an operations group that may run every runbook. For selected-runbook execution, pair Job Operator at the account with Runbook Operator only on approved runbooks and keep target-resource access on the runbook identity.
Related roles (2)
- Automation Runbook Operator: Microsoft documents the combination for execution restricted to selected runbooks.
- Automation Operator: Runs and schedules all runbooks in the account without the two-role scoping pattern.
Common questions
When should I assign the Automation Job Operator Azure role?
Assign Automation Job Operator when you need to: Submit, stop, suspend, resume, and inspect jobs and outputs for all runbooks in an Automation account.; and Operate production runbooks while protecting their definitions and stored Automation assets from modification.. Practical scope: Assign at the Automation account. When paired with resource-group read access, the operator can start any runbook in that account; combine with Automation Runbook Operator at individual runbook scope when only selected runbooks should execute.
What permissions does the Automation Job Operator Azure role grant?
The role definition grants 13 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Automation/automationAccounts/hybridRunbookWorkerGroups/read; Microsoft.Automation/automationAccounts/jobs/read; Microsoft.Automation/automationAccounts/jobs/resume/action; Microsoft.Automation/automationAccounts/jobs/stop/action; and Microsoft.Automation/automationAccounts/jobs/streams/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Automation Job Operator Azure role?
Key considerations when assigning Automation Job Operator: Starting a runbook can cause any action available to that runbook's managed identity or stored credentials.; Job streams and output can disclose operational data or secrets written by runbook code.; and The role does not edit runbooks, but execution of trusted privileged automation remains security-sensitive.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Management and governance →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Manage role permissions and security in Azure Automation →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Runbook execution in Azure Automation →
Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.