Azure Compute built-in role
Azure Batch Job Submitter
Reads existing Batch applications, application-package versions, and pools, and creates and manages Batch jobs and job schedules through DataActions. It does not manage the Batch account, applications, or pools.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 48e5e92e-a480-4e71-aa9c-2778f4c13781
Control-plane actions (5)
Microsoft.Batch/batchAccounts/applications/readMicrosoft.Batch/batchAccounts/applications/versions/readMicrosoft.Batch/batchAccounts/pools/readMicrosoft.Insights/alertRules/*Microsoft.Resources/subscriptions/resourceGroups/read
Data-plane actions (2)
Microsoft.Batch/batchAccounts/jobSchedules/*Microsoft.Batch/batchAccounts/jobs/*
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign at the Batch account containing the approved pools and applications. Parent-scope assignments are inherited by all contained Batch accounts. Job and schedule writes are Batch data-plane permissions; the supporting pool and application visibility is in the control plane.
Common use cases (2)
- Let a workload team submit, monitor, update, and delete jobs and schedules that use approved existing pools and application packages.
- Run a job-submission service principal without granting pool or account administration.
Prerequisites (2)
- The Batch account, target pools, and required application packages must already exist, and the client must use Microsoft Entra authentication.
- Jobs that create autopools require pool write permissions, so use a suitable custom role or Azure Batch Data Contributor for that scenario.
Best practices (3)
- Use a dedicated managed identity or service principal for automated job submission and scope it to the Batch account.
- Use pool managed identities rather than task-supplied credentials to reach downstream Azure services.
- Restrict Batch endpoints and pool-node remote access in accordance with the Batch security guidance.
Security considerations (4)
- Job and schedule management can execute code on existing Batch pools and consume significant compute capacity.
- Batch tasks run as a standard non-administrative account by default, but a submitted task can be configured to use an elevated account; pool and task identity policy must constrain that authority.
- The role has data-plane writes even though it cannot modify pools or the Batch account.
- It does not govern shared-key requests, which retain full account access if shared-key authentication remains enabled.
Assignment guidance
Use Azure Batch Job Submitter for the job-running identity at the individual Batch account. Escalate to Data Contributor only when that identity must also create or change pools or application packages; do not use Account Contributor for routine submission.
Related roles (2)
- Azure Batch Data Contributor: Adds application-package and pool management, including the pool writes needed by autopool jobs.
- Azure Batch Account Reader: Read-only documented alternative when the principal should inspect jobs but not submit or manage them.
Common questions
When should I assign the Azure Batch Job Submitter Azure role?
Assign Azure Batch Job Submitter when you need to: Let a workload team submit, monitor, update, and delete jobs and schedules that use approved existing pools and application packages.; and Run a job-submission service principal without granting pool or account administration.. Practical scope: Assign at the Batch account containing the approved pools and applications. Parent-scope assignments are inherited by all contained Batch accounts. Job and schedule writes are Batch data-plane permissions; the supporting pool and application visibility is in the control plane.
What permissions does the Azure Batch Job Submitter Azure role grant?
The role definition grants 7 combined control-plane and data-plane actions. Representative operations include: Microsoft.Batch/batchAccounts/applications/read; Microsoft.Batch/batchAccounts/applications/versions/read; Microsoft.Batch/batchAccounts/pools/read; Microsoft.Insights/alertRules/*; Microsoft.Resources/subscriptions/resourceGroups/read; and Microsoft.Batch/batchAccounts/jobSchedules/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Batch Job Submitter Azure role?
Key considerations when assigning Azure Batch Job Submitter: Job and schedule management can execute code on existing Batch pools and consume significant compute capacity.; Batch tasks run as a standard non-administrative account by default, but a submitted task can be configured to use an elevated account; pool and task identity policy must constrain that authority.; The role has data-plane writes even though it cannot modify pools or the Batch account.; and It does not govern shared-key requests, which retain full account access if shared-key authentication remains enabled.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (8)
- Azure built-in roles for Compute →
Supports: Description, Practical scope. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Role-based access control for Azure Batch service →
Supports: Description, Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Batch security and compliance best practices →
Supports: Best practices. Retrieved 2026-07-16.
- Jobs and tasks in Azure Batch →
Supports: Common use cases, Security considerations. Retrieved 2026-07-16.
- Run tasks under user accounts →
Supports: Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.