Azure Management and governance built-in role

Automation Operator

Views runbook names and properties and starts, stops, suspends, resumes, and schedules jobs for all runbooks in an Automation account without reading or modifying runbook definitions and other protected Automation assets.

Control-plane actions (21)

• Microsoft.Authorization/*/read
• Microsoft.Automation/automationAccounts/hybridRunbookWorkerGroups/read
• Microsoft.Automation/automationAccounts/jobs/read
• Microsoft.Automation/automationAccounts/jobs/resume/action
• Microsoft.Automation/automationAccounts/jobs/stop/action
• Microsoft.Automation/automationAccounts/jobs/streams/read
• Microsoft.Automation/automationAccounts/jobs/suspend/action
• Microsoft.Automation/automationAccounts/jobs/write
• Microsoft.Automation/automationAccounts/jobSchedules/read
• Microsoft.Automation/automationAccounts/jobSchedules/write
• Microsoft.Automation/automationAccounts/linkedWorkspace/read
• Microsoft.Automation/automationAccounts/read
• Microsoft.Automation/automationAccounts/runbooks/read
• Microsoft.Automation/automationAccounts/schedules/read
• Microsoft.Automation/automationAccounts/schedules/write
• Microsoft.Insights/alertRules/*
• Microsoft.ResourceHealth/availabilityStatuses/read
• Microsoft.Resources/deployments/*
• Microsoft.Automation/automationAccounts/jobs/output/read
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Support/*

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign at the Automation account when the operator may execute every runbook. Microsoft advises using Automation Job Operator plus Automation Runbook Operator instead when access must be limited to individual runbooks.

Common use cases (2)

• Run and schedule approved operational runbooks while keeping credentials, variables, configurations, and source definitions protected.
• Operate all runbooks in one Automation account without account administration.

Prerequisites (2)

• Runbooks, schedules, and the execution identity or credentials must already be configured.
• Confirm that the operator is authorized to execute every runbook in the account.

Best practices (2)

• Use separate Automation accounts or the Job Operator plus Runbook Operator combination when execution responsibilities differ.
• Review runbook output access and the downstream permissions of every runbook identity before assigning this role.

Security considerations (2)

• Execution can trigger privileged downstream actions even though this role cannot read or edit the runbook source.
• Job output and schedules can reveal or alter operational behavior, and repeated execution can affect availability or cost.

Assignment guidance

Assign Automation Operator at the account only to operators authorized to run all contained runbooks. Use the scoped two-role pattern for selected runbooks and keep management duties on Automation Contributor.

Related roles (2)

• Automation Job Operator: Account-level job role used with Runbook Operator for selected-runbook execution.
• Automation Runbook Operator: Runbook-scope role used with Job Operator for selected-runbook execution.

Editorial sources (6)

• Azure built-in roles for Management and governance →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Manage role permissions and security in Azure Automation →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Runbook execution in Azure Automation →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →