Azure Compute built-in role

Azure Batch Job Submitter

Reads existing Batch applications, application-package versions, and pools, and creates and manages Batch jobs and job schedules through DataActions. It does not manage the Batch account, applications, or pools.

Control-plane actions (5)

• Microsoft.Batch/batchAccounts/applications/read
• Microsoft.Batch/batchAccounts/applications/versions/read
• Microsoft.Batch/batchAccounts/pools/read
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/subscriptions/resourceGroups/read

Data-plane actions (2)

• Microsoft.Batch/batchAccounts/jobSchedules/*
• Microsoft.Batch/batchAccounts/jobs/*

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign at the Batch account containing the approved pools and applications. Parent-scope assignments are inherited by all contained Batch accounts. Job and schedule writes are Batch data-plane permissions; the supporting pool and application visibility is in the control plane.

Common use cases (2)

• Let a workload team submit, monitor, update, and delete jobs and schedules that use approved existing pools and application packages.
• Run a job-submission service principal without granting pool or account administration.

Prerequisites (2)

• The Batch account, target pools, and required application packages must already exist, and the client must use Microsoft Entra authentication.
• Jobs that create autopools require pool write permissions, so use a suitable custom role or Azure Batch Data Contributor for that scenario.

Best practices (3)

• Use a dedicated managed identity or service principal for automated job submission and scope it to the Batch account.
• Use pool managed identities rather than task-supplied credentials to reach downstream Azure services.
• Restrict Batch endpoints and pool-node remote access in accordance with the Batch security guidance.

Security considerations (4)

• Job and schedule management can execute code on existing Batch pools and consume significant compute capacity.
• Batch tasks run as a standard non-administrative account by default, but a submitted task can be configured to use an elevated account; pool and task identity policy must constrain that authority.
• The role has data-plane writes even though it cannot modify pools or the Batch account.
• It does not govern shared-key requests, which retain full account access if shared-key authentication remains enabled.

Assignment guidance

Use Azure Batch Job Submitter for the job-running identity at the individual Batch account. Escalate to Data Contributor only when that identity must also create or change pools or application packages; do not use Account Contributor for routine submission.

Related roles (2)

• Azure Batch Data Contributor: Adds application-package and pool management, including the pool writes needed by autopool jobs.
• Azure Batch Account Reader: Read-only documented alternative when the principal should inspect jobs but not submit or manage them.

Editorial sources (8)

• Azure built-in roles for Compute →

  Supports: Description, Practical scope. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Role-based access control for Azure Batch service →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Batch security and compliance best practices →

  Supports: Best practices. Retrieved 2026-07-16.

• Jobs and tasks in Azure Batch →

  Supports: Common use cases, Security considerations. Retrieved 2026-07-16.

• Run tasks under user accounts →

  Supports: Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →