Azure Compute built-in role

Azure Batch Account Contributor

Fully manages Azure Batch accounts, applications, pools, jobs, and job schedules. The role spans both Azure Resource Manager Actions and Batch service DataActions, including account-key operations, so it is the broadest of the four documented Batch job-function roles.

Control-plane actions (5)

• Microsoft.Authorization/*/read
• Microsoft.Batch/*
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read

Data-plane actions (1)

• Microsoft.Batch/*

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign at a Batch account when one identity administers only that account, or at a resource group, subscription, or management group only when inherited access to every contained Batch account is intended. Both the control plane and Batch data plane are granted; shared-key credentials remain a separate full-access authentication path.

Common use cases (2)

• Administer the lifecycle and configuration of a Batch account together with its applications, pools, jobs, and schedules.
• Run trusted automation that must manage both Batch account settings and Batch workload objects.

Prerequisites (2)

• Use a Microsoft Entra user, group, service principal, or managed identity; Batch RBAC roles do not govern requests authenticated with Batch shared keys.
• Confirm that account creation, modification, key operations, pool management, and job management are all required before selecting this role.

Best practices (3)

• Prefer Azure Batch Data Contributor or Azure Batch Job Submitter when account-level administration is unnecessary.
• Restrict the Batch account to Microsoft Entra authentication where supported and avoid distributing shared keys.
• Use private endpoints or restricted network access, simplified node communication, managed identities for pool access, and supported patched images.

Security considerations (3)

• The role can list or regenerate Batch account keys and can manage every Batch control-plane and data-plane resource in scope.
• Batch shared keys bypass Azure RBAC duty separation by granting full Batch account access; protect or disable that authentication path independently.
• Pool and job control can schedule code across Batch compute nodes. Tasks run as non-administrative users by default but can be configured to use elevated accounts, so task identity and pool isolation require separate controls.

Assignment guidance

Reserve Azure Batch Account Contributor for trusted Batch platform administrators or automation that genuinely needs account, pool, and job control. Assign at the individual Batch account where practical and use the narrower Data Contributor, Job Submitter, or Account Reader roles for separated duties.

Related roles (3)

• Azure Batch Data Contributor: Microsoft documents it as managing pools and jobs without modifying the Batch account.
• Azure Batch Job Submitter: Microsoft documents it as the narrower role for submitting and managing jobs and schedules against existing pools and applications.
• Azure Batch Account Reader: Microsoft documents it as view access to account resources, pools, and jobs without modification.

Editorial sources (8)

• Azure built-in roles for Compute →

  Supports: Description, Practical scope. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Role-based access control for Azure Batch service →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Batch security and compliance best practices →

  Supports: Best practices, Security considerations. Retrieved 2026-07-16.

• Jobs and tasks in Azure Batch →

  Supports: Common use cases. Retrieved 2026-07-16.

• Run tasks under user accounts →

  Supports: Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →