Azure Management and governance built-in role
Automation Operator
Views runbook names and properties and starts, stops, suspends, resumes, and schedules jobs for all runbooks in an Automation account without reading or modifying runbook definitions and other protected Automation assets.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: d3881f73-407a-4167-8283-e981cbba0404
Control-plane actions (21)
Microsoft.Authorization/*/readMicrosoft.Automation/automationAccounts/hybridRunbookWorkerGroups/readMicrosoft.Automation/automationAccounts/jobs/readMicrosoft.Automation/automationAccounts/jobs/resume/actionMicrosoft.Automation/automationAccounts/jobs/stop/actionMicrosoft.Automation/automationAccounts/jobs/streams/readMicrosoft.Automation/automationAccounts/jobs/suspend/actionMicrosoft.Automation/automationAccounts/jobs/writeMicrosoft.Automation/automationAccounts/jobSchedules/readMicrosoft.Automation/automationAccounts/jobSchedules/writeMicrosoft.Automation/automationAccounts/linkedWorkspace/readMicrosoft.Automation/automationAccounts/readMicrosoft.Automation/automationAccounts/runbooks/readMicrosoft.Automation/automationAccounts/schedules/readMicrosoft.Automation/automationAccounts/schedules/writeMicrosoft.Insights/alertRules/*Microsoft.ResourceHealth/availabilityStatuses/readMicrosoft.Resources/deployments/*Microsoft.Automation/automationAccounts/jobs/output/readMicrosoft.Resources/subscriptions/resourceGroups/readMicrosoft.Support/*
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign at the Automation account when the operator may execute every runbook. Microsoft advises using Automation Job Operator plus Automation Runbook Operator instead when access must be limited to individual runbooks.
Common use cases (2)
- Run and schedule approved operational runbooks while keeping credentials, variables, configurations, and source definitions protected.
- Operate all runbooks in one Automation account without account administration.
Prerequisites (2)
- Runbooks, schedules, and the execution identity or credentials must already be configured.
- Confirm that the operator is authorized to execute every runbook in the account.
Best practices (2)
- Use separate Automation accounts or the Job Operator plus Runbook Operator combination when execution responsibilities differ.
- Review runbook output access and the downstream permissions of every runbook identity before assigning this role.
Security considerations (2)
- Execution can trigger privileged downstream actions even though this role cannot read or edit the runbook source.
- Job output and schedules can reveal or alter operational behavior, and repeated execution can affect availability or cost.
Assignment guidance
Assign Automation Operator at the account only to operators authorized to run all contained runbooks. Use the scoped two-role pattern for selected runbooks and keep management duties on Automation Contributor.
Related roles (2)
- Automation Job Operator: Account-level job role used with Runbook Operator for selected-runbook execution.
- Automation Runbook Operator: Runbook-scope role used with Job Operator for selected-runbook execution.
Common questions
When should I assign the Automation Operator Azure role?
Assign Automation Operator when you need to: Run and schedule approved operational runbooks while keeping credentials, variables, configurations, and source definitions protected.; and Operate all runbooks in one Automation account without account administration.. Practical scope: Assign at the Automation account when the operator may execute every runbook. Microsoft advises using Automation Job Operator plus Automation Runbook Operator instead when access must be limited to individual runbooks.
What permissions does the Automation Operator Azure role grant?
The role definition grants 21 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Automation/automationAccounts/hybridRunbookWorkerGroups/read; Microsoft.Automation/automationAccounts/jobs/read; Microsoft.Automation/automationAccounts/jobs/resume/action; Microsoft.Automation/automationAccounts/jobs/stop/action; and Microsoft.Automation/automationAccounts/jobs/streams/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Automation Operator Azure role?
Key considerations when assigning Automation Operator: Execution can trigger privileged downstream actions even though this role cannot read or edit the runbook source.; and Job output and schedules can reveal or alter operational behavior, and repeated execution can affect availability or cost.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Management and governance →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Manage role permissions and security in Azure Automation →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Runbook execution in Azure Automation →
Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.