Azure Compute built-in role

Azure Batch Data Contributor

Manages Batch applications, application packages, pools, jobs, and job schedules while reading but not modifying the Batch account itself. Pool and application operations are control-plane Actions, while jobs and schedules are Batch service DataActions.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: 6aaa78f1-f7de-44ca-8722-c64a23943cae

Control-plane actions (11)

Data-plane actions (2)

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

Assign at the Batch account for one workload boundary; broader assignments are inherited by every Batch account below the selected resource group, subscription, or management group. The role crosses control and data planes and can manage the compute environment in which tasks execute.

Common use cases (2)

Prerequisites (2)

Best practices (3)

Security considerations (3)

Assignment guidance

Assign Azure Batch Data Contributor to a workload administrator that owns applications, pools, jobs, and schedules in an existing Batch account. Use Job Submitter for job-only duties and Account Contributor only when account or key administration is also required.

Related roles (2)

Common questions

When should I assign the Azure Batch Data Contributor Azure role?

Assign Azure Batch Data Contributor when you need to: Operate an existing Batch account by maintaining application packages and pools and by creating and managing jobs and schedules.; and Delegate Batch workload administration without granting account updates or account-key management.. Practical scope: Assign at the Batch account for one workload boundary; broader assignments are inherited by every Batch account below the selected resource group, subscription, or management group. The role crosses control and data planes and can manage the compute environment in which tasks execute.

What permissions does the Azure Batch Data Contributor Azure role grant?

The role definition grants 13 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Batch/batchAccounts/read; Microsoft.Batch/batchAccounts/applications/*; Microsoft.Batch/batchAccounts/certificates/*; Microsoft.Batch/batchAccounts/certificateOperationResults/*; and Microsoft.Batch/batchAccounts/pools/*. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Azure Batch Data Contributor Azure role?

Key considerations when assigning Azure Batch Data Contributor: The assignee can change pools and application packages and submit code for execution on Batch compute nodes.; The role includes Batch data-plane writes for jobs and schedules even though it cannot modify the account resource.; and Published permissions still mention the retired Batch certificate feature; that presence must not be interpreted as supported certificate-based account functionality.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (8)

Official Microsoft Learn documentation →