Azure Management and governance built-in role

Automation Runbook Operator

Reads the name and properties of an individual Automation runbook so that, when combined with Automation Job Operator at the account, the assignee can create jobs for that selected runbook. It does not edit the runbook or independently provide complete job execution access.

Control-plane actions (6)

• Microsoft.Authorization/*/read
• Microsoft.Automation/automationAccounts/runbooks/read
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Support/*

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign directly on each approved runbook and pair it with Automation Job Operator at the containing Automation account. The two scopes deliberately separate account-level job operations from the set of runbooks the principal can select.

Common use cases (2)

• Allow an operator to execute only a selected subset of runbooks in an Automation account.
• Delegate application-specific runbooks without exposing unrelated runbook definitions or Automation assets.

Prerequisites (2)

• The assignee must also hold Automation Job Operator on the containing Automation account.
• The approved runbooks and their managed identities or credentials must already be configured.

Best practices (2)

• Assign only on named runbooks and remove access when the operational responsibility ends.
• Review downstream permissions and output sensitivity for each runbook independently.

Security considerations (2)

• The combination with Job Operator permits execution of the selected runbook using its configured identity or credentials.
• This role alone is not account administration and has no DataActions, but selected runbooks can still perform privileged downstream work.

Assignment guidance

Assign on each approved runbook and pair with Automation Job Operator at the account. Do not replace the pair with Automation Operator unless execution of every runbook is intended.

Related roles (1)

• Automation Job Operator: Required account-level companion in Microsoft's selected-runbook execution pattern.

Editorial sources (6)

• Azure built-in roles for Management and governance →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Manage role permissions and security in Azure Automation →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Runbook execution in Azure Automation →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →