Azure DevOps built-in role

Chaos Studio Target Contributor

Creates, reads, updates, and deletes Chaos Studio target and capability resources but cannot create or run experiments or view their execution details. The role has control-plane Actions only and no DataActions.

Control-plane actions (12)

• Microsoft.Chaos/targets/write
• Microsoft.Chaos/targets/delete
• Microsoft.Chaos/targets/read
• Microsoft.Chaos/targets/capabilities/write
• Microsoft.Chaos/targets/capabilities/delete
• Microsoft.Chaos/targets/capabilities/read
• Microsoft.Chaos/locations/targetTypes/read
• Microsoft.Chaos/locations/targetTypes/capabilityTypes/read
• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the individual Azure resource being onboarded as a Chaos Studio target or on a tightly bounded resource group containing approved targets. Each target is unique to a resource, and parent-scope assignments cover every inherited target and capability.

Common use cases (2)

• Let a platform owner onboard approved resources to Chaos Studio and enable only the fault capabilities that resilience teams may use.
• Separate target eligibility and capability configuration from experiment authoring and execution.

Prerequisites (2)

• Identify the supported target type and the exact capabilities required by the approved experiment design.
• Confirm the target owner authorizes fault injection and that the experiment identity will receive separate fault-specific permissions.

Best practices (3)

• Enable only the capabilities required for approved experiments and review target registrations when tests or services are retired.
• Assign directly on each target resource when a resource-group assignment would let the principal onboard unrelated services.
• Keep experiment start authority on Chaos Studio Operator or Experiment Contributor rather than combining it with target onboarding by default.

Security considerations (3)

• Onboarding and capability enablement make a resource eligible for specific fault injection, although this role cannot start the experiment.
• A resource-group or subscription assignment allows the principal to register more resources and capabilities than a target-scoped assignment.
• The experiment still fails unless its managed identity has the appropriate target-resource permissions, providing a separate authorization layer.

Assignment guidance

Assign Chaos Studio Target Contributor directly on approved target resources to the platform team responsible for onboarding. Grant experiment execution separately and give the experiment managed identity only the fault-specific permissions it needs on each target.

Related roles (2)

• Chaos Studio Experiment Contributor: Combines target and capability management with experiment creation and execution.
• Chaos Studio Operator: Runs existing experiments but cannot onboard targets or manage capabilities.

Editorial sources (6)

• Azure built-in roles for DevOps - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Permissions and security in Azure Chaos Studio →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →