Azure Networking built-in role

CDN Endpoint Contributor

Manages Azure CDN endpoint resources under a profile without granting Azure RBAC access. The definition also grants operation-result, deployment, classic alert-rule, support-ticket, authorization-read, edge-node-read, and resource-group-read Actions. It has no DataActions.

Control-plane actions (8)

• Microsoft.Authorization/*/read
• Microsoft.Cdn/edgenodes/read
• Microsoft.Cdn/operationresults/*
• Microsoft.Cdn/profiles/endpoints/*
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Support/*

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

A CDN endpoint is created under a named CDN profile. Assign the role at the endpoint, containing profile, or dedicated resource group needed for the task. At resource-group or broader scope, its deployment, alert, and support Actions apply to corresponding resources throughout that scope, not only to one endpoint.

Common use cases (2)

• Create or update a CDN endpoint under an approved profile, including the documented origin and delivery configuration.
• Operate the lifecycle of a defined CDN endpoint without granting management of every profile resource or Azure RBAC delegation.

Prerequisites (2)

• Identify the CDN profile, endpoint name, resource group, and approved origin required by the current CDN endpoint workflow.
• Identify the principal and the narrowest endpoint, profile, or resource-group scope it needs; the assigning administrator needs Microsoft.Authorization/roleAssignments/write at that scope.

Best practices (3)

• Scope the role to the endpoint or dedicated profile boundary instead of a subscription when the principal manages only a limited delivery configuration.
• Review origin and delivery changes before production rollout because endpoint configuration controls where and how content is served.
• Review the deployment, classic alert-rule, and support-ticket wildcards independently from the endpoint permission.

Security considerations (3)

• Changing an endpoint origin or delivery configuration can redirect traffic, change content delivery behavior, or make the endpoint unavailable.
• Deleting an endpoint or misconfiguring its origin can cause a production outage even though the role cannot change RBAC assignments.
• The role has no DataActions, but its control-plane authority directly affects delivery of application content.

Assignment guidance

Assign CDN Endpoint Contributor to principals responsible for a defined CDN endpoint under an approved profile. Prefer endpoint or profile scope, and approve the ancillary deployment, alert, and support permissions whenever a broader scope is used.

Related roles (2)

• CDN Endpoint Reader: Microsoft describes CDN Endpoint Reader as the read-only counterpart that can view endpoints without changing them.
• CDN Profile Contributor: CDN Profile Contributor is the broader write role because Microsoft says it manages profiles and their endpoints; current CDN commands place an endpoint under a profile.

Editorial sources (5)

• Azure built-in roles for Networking →

  Supports: Description, Practical scope, Common use cases, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• az cdn endpoint →

  Supports: Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →