Azure Compute built-in role
Azure Batch Account Contributor
Fully manages Azure Batch accounts, applications, pools, jobs, and job schedules. The role spans both Azure Resource Manager Actions and Batch service DataActions, including account-key operations, so it is the broadest of the four documented Batch job-function roles.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 29fe4964-1e60-436b-bd3a-77fd4c178b3c
Control-plane actions (5)
Microsoft.Authorization/*/readMicrosoft.Batch/*Microsoft.Insights/alertRules/*Microsoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/read
Data-plane actions (1)
Microsoft.Batch/*
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign at a Batch account when one identity administers only that account, or at a resource group, subscription, or management group only when inherited access to every contained Batch account is intended. Both the control plane and Batch data plane are granted; shared-key credentials remain a separate full-access authentication path.
Common use cases (2)
- Administer the lifecycle and configuration of a Batch account together with its applications, pools, jobs, and schedules.
- Run trusted automation that must manage both Batch account settings and Batch workload objects.
Prerequisites (2)
- Use a Microsoft Entra user, group, service principal, or managed identity; Batch RBAC roles do not govern requests authenticated with Batch shared keys.
- Confirm that account creation, modification, key operations, pool management, and job management are all required before selecting this role.
Best practices (3)
- Prefer Azure Batch Data Contributor or Azure Batch Job Submitter when account-level administration is unnecessary.
- Restrict the Batch account to Microsoft Entra authentication where supported and avoid distributing shared keys.
- Use private endpoints or restricted network access, simplified node communication, managed identities for pool access, and supported patched images.
Security considerations (3)
- The role can list or regenerate Batch account keys and can manage every Batch control-plane and data-plane resource in scope.
- Batch shared keys bypass Azure RBAC duty separation by granting full Batch account access; protect or disable that authentication path independently.
- Pool and job control can schedule code across Batch compute nodes. Tasks run as non-administrative users by default but can be configured to use elevated accounts, so task identity and pool isolation require separate controls.
Assignment guidance
Reserve Azure Batch Account Contributor for trusted Batch platform administrators or automation that genuinely needs account, pool, and job control. Assign at the individual Batch account where practical and use the narrower Data Contributor, Job Submitter, or Account Reader roles for separated duties.
Related roles (3)
- Azure Batch Data Contributor: Microsoft documents it as managing pools and jobs without modifying the Batch account.
- Azure Batch Job Submitter: Microsoft documents it as the narrower role for submitting and managing jobs and schedules against existing pools and applications.
- Azure Batch Account Reader: Microsoft documents it as view access to account resources, pools, and jobs without modification.
Common questions
When should I assign the Azure Batch Account Contributor Azure role?
Assign Azure Batch Account Contributor when you need to: Administer the lifecycle and configuration of a Batch account together with its applications, pools, jobs, and schedules.; and Run trusted automation that must manage both Batch account settings and Batch workload objects.. Practical scope: Assign at a Batch account when one identity administers only that account, or at a resource group, subscription, or management group only when inherited access to every contained Batch account is intended. Both the control plane and Batch data plane are granted; shared-key credentials remain a separate full-access authentication path.
What permissions does the Azure Batch Account Contributor Azure role grant?
The role definition grants 6 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Batch/*; Microsoft.Insights/alertRules/*; Microsoft.Resources/deployments/*; Microsoft.Resources/subscriptions/resourceGroups/read; and Microsoft.Batch/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Batch Account Contributor Azure role?
Key considerations when assigning Azure Batch Account Contributor: The role can list or regenerate Batch account keys and can manage every Batch control-plane and data-plane resource in scope.; Batch shared keys bypass Azure RBAC duty separation by granting full Batch account access; protect or disable that authentication path independently.; and Pool and job control can schedule code across Batch compute nodes. Tasks run as non-administrative users by default but can be configured to use elevated accounts, so task identity and pool isolation require separate controls.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (8)
- Azure built-in roles for Compute →
Supports: Description, Practical scope. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Role-based access control for Azure Batch service →
Supports: Description, Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Batch security and compliance best practices →
Supports: Best practices, Security considerations. Retrieved 2026-07-16.
- Jobs and tasks in Azure Batch →
Supports: Common use cases. Retrieved 2026-07-16.
- Run tasks under user accounts →
Supports: Best practices, Security considerations. Retrieved 2026-07-16.