Azure Management and governance built-in role

Automation Job Operator

Creates and manages jobs for every runbook in an Automation account and can read job streams and output. Microsoft documents assignment at the Automation account scope; resource-group read access is also needed to start runbooks. It does not edit runbook definitions or other Automation assets.

Control-plane actions (13)

• Microsoft.Authorization/*/read
• Microsoft.Automation/automationAccounts/hybridRunbookWorkerGroups/read
• Microsoft.Automation/automationAccounts/jobs/read
• Microsoft.Automation/automationAccounts/jobs/resume/action
• Microsoft.Automation/automationAccounts/jobs/stop/action
• Microsoft.Automation/automationAccounts/jobs/streams/read
• Microsoft.Automation/automationAccounts/jobs/suspend/action
• Microsoft.Automation/automationAccounts/jobs/write
• Microsoft.Automation/automationAccounts/jobs/output/read
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Support/*

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign at the Automation account. When paired with resource-group read access, the operator can start any runbook in that account; combine with Automation Runbook Operator at individual runbook scope when only selected runbooks should execute.

Common use cases (2)

• Submit, stop, suspend, resume, and inspect jobs and outputs for all runbooks in an Automation account.
• Operate production runbooks while protecting their definitions and stored Automation assets from modification.

Prerequisites (2)

• The runbooks and their execution identities or credentials must already be configured.
• Grant read access on the resource group containing the Automation account when the operator must start runbooks.

Best practices (2)

• Use the Runbook Operator combination when execution must be restricted to named runbooks.
• Treat job output as potentially sensitive and enforce Hybrid Runbook Worker targeting where organizational policy requires it.

Security considerations (3)

• Starting a runbook can cause any action available to that runbook's managed identity or stored credentials.
• Job streams and output can disclose operational data or secrets written by runbook code.
• The role does not edit runbooks, but execution of trusted privileged automation remains security-sensitive.

Assignment guidance

Assign at the Automation account to an operations group that may run every runbook. For selected-runbook execution, pair Job Operator at the account with Runbook Operator only on approved runbooks and keep target-resource access on the runbook identity.

Related roles (2)

• Automation Runbook Operator: Microsoft documents the combination for execution restricted to selected runbooks.
• Automation Operator: Runs and schedules all runbooks in the account without the two-role scoping pattern.

Editorial sources (6)

• Azure built-in roles for Management and governance →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Manage role permissions and security in Azure Automation →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Runbook execution in Azure Automation →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →