Azure Management and governance built-in role
Automation Runbook Operator
Reads the name and properties of an individual Automation runbook so that, when combined with Automation Job Operator at the account, the assignee can create jobs for that selected runbook. It does not edit the runbook or independently provide complete job execution access.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 5fb5aef8-1081-4b8e-bb16-9d5d0385bab5
Control-plane actions (6)
Microsoft.Authorization/*/readMicrosoft.Automation/automationAccounts/runbooks/readMicrosoft.Insights/alertRules/*Microsoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.Support/*
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign directly on each approved runbook and pair it with Automation Job Operator at the containing Automation account. The two scopes deliberately separate account-level job operations from the set of runbooks the principal can select.
Common use cases (2)
- Allow an operator to execute only a selected subset of runbooks in an Automation account.
- Delegate application-specific runbooks without exposing unrelated runbook definitions or Automation assets.
Prerequisites (2)
- The assignee must also hold Automation Job Operator on the containing Automation account.
- The approved runbooks and their managed identities or credentials must already be configured.
Best practices (2)
- Assign only on named runbooks and remove access when the operational responsibility ends.
- Review downstream permissions and output sensitivity for each runbook independently.
Security considerations (2)
- The combination with Job Operator permits execution of the selected runbook using its configured identity or credentials.
- This role alone is not account administration and has no DataActions, but selected runbooks can still perform privileged downstream work.
Assignment guidance
Assign on each approved runbook and pair with Automation Job Operator at the account. Do not replace the pair with Automation Operator unless execution of every runbook is intended.
Related roles (1)
- Automation Job Operator: Required account-level companion in Microsoft's selected-runbook execution pattern.
Common questions
When should I assign the Automation Runbook Operator Azure role?
Assign Automation Runbook Operator when you need to: Allow an operator to execute only a selected subset of runbooks in an Automation account.; and Delegate application-specific runbooks without exposing unrelated runbook definitions or Automation assets.. Practical scope: Assign directly on each approved runbook and pair it with Automation Job Operator at the containing Automation account. The two scopes deliberately separate account-level job operations from the set of runbooks the principal can select.
What permissions does the Automation Runbook Operator Azure role grant?
The role definition grants 6 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Automation/automationAccounts/runbooks/read; Microsoft.Insights/alertRules/*; Microsoft.Resources/deployments/*; Microsoft.Resources/subscriptions/resourceGroups/read; and Microsoft.Support/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Automation Runbook Operator Azure role?
Key considerations when assigning Automation Runbook Operator: The combination with Job Operator permits execution of the selected runbook using its configured identity or credentials.; and This role alone is not account administration and has no DataActions, but selected runbooks can still perform privileged downstream work.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Management and governance →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Manage role permissions and security in Azure Automation →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Runbook execution in Azure Automation →
Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.