Azure Compute built-in role

Azure Batch Data Contributor

Manages Batch applications, application packages, pools, jobs, and job schedules while reading but not modifying the Batch account itself. Pool and application operations are control-plane Actions, while jobs and schedules are Batch service DataActions.

Control-plane actions (11)

• Microsoft.Authorization/*/read
• Microsoft.Batch/batchAccounts/read
• Microsoft.Batch/batchAccounts/applications/*
• Microsoft.Batch/batchAccounts/certificates/*
• Microsoft.Batch/batchAccounts/certificateOperationResults/*
• Microsoft.Batch/batchAccounts/pools/*
• Microsoft.Batch/batchAccounts/poolOperationResults/*
• Microsoft.Batch/locations/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read

Data-plane actions (2)

• Microsoft.Batch/batchAccounts/jobSchedules/*
• Microsoft.Batch/batchAccounts/jobs/*

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign at the Batch account for one workload boundary; broader assignments are inherited by every Batch account below the selected resource group, subscription, or management group. The role crosses control and data planes and can manage the compute environment in which tasks execute.

Common use cases (2)

• Operate an existing Batch account by maintaining application packages and pools and by creating and managing jobs and schedules.
• Delegate Batch workload administration without granting account updates or account-key management.

Prerequisites (2)

• The Batch account must already exist and the assignee must authenticate with Microsoft Entra ID.
• Review whether the workload needs pool writes; jobs that use autopools require pool-level write permissions and therefore are not covered by a job-only role.

Best practices (3)

• Use Azure Batch Job Submitter when the principal only needs jobs and schedules on existing pools.
• Keep the assignment at the Batch account and isolate workload teams into separate accounts when their pool and application administration must not overlap.
• Use managed identities for pool access to other Azure services and reduce public endpoint exposure for accounts and compute nodes.

Security considerations (3)

• The assignee can change pools and application packages and submit code for execution on Batch compute nodes.
• The role includes Batch data-plane writes for jobs and schedules even though it cannot modify the account resource.
• Published permissions still mention the retired Batch certificate feature; that presence must not be interpreted as supported certificate-based account functionality.

Assignment guidance

Assign Azure Batch Data Contributor to a workload administrator that owns applications, pools, jobs, and schedules in an existing Batch account. Use Job Submitter for job-only duties and Account Contributor only when account or key administration is also required.

Related roles (2)

• Azure Batch Job Submitter: Narrower documented role for jobs and schedules using existing pools and application packages.
• Azure Batch Account Contributor: Adds Batch account creation, modification, key operations, and full account control.

Editorial sources (8)

• Azure built-in roles for Compute →

  Supports: Description, Practical scope. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Role-based access control for Azure Batch service →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Batch security and compliance best practices →

  Supports: Best practices. Retrieved 2026-07-16.

• Jobs and tasks in Azure Batch →

  Supports: Common use cases. Retrieved 2026-07-16.

• Run tasks under user accounts →

  Supports: Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →