Azure Compute built-in role
Compute Fleet Contributor
Creates and manages Azure Compute Fleet resources. It controls fleet definitions and deployments, but the Azure Fleet resource provider requires separately documented permissions to create and operate the underlying virtual-machine, network, identity, and gallery resources.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 2bed379c-9fba-455b-99e4-6b911073bcf2
Control-plane actions (6)
Microsoft.AzureFleet/fleets/*Microsoft.Authorization/*/readMicrosoft.Insights/alertRules/*Microsoft.ResourceHealth/availabilityStatuses/readMicrosoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign at the resource group that contains the fleet when possible; resource-group, subscription, and management-group assignments are inherited by child fleets. The role is control-plane only and has no DataActions, but a fleet can launch and maintain large numbers of Spot and standard VMs.
Common use cases (2)
- Create and manage a fleet that selects across approved VM sizes and allocation strategies for capacity or cost goals.
- Operate large stateless, batch, rendering, analytics, or CI workloads through a managed fleet definition.
Prerequisites (3)
- Register the Microsoft.AzureFleet resource provider in the subscription before creating a fleet.
- Configure the Azure Fleet resource provider with the documented Virtual Machine Contributor, Network Contributor, and Managed Identity Operator access, plus gallery access when gallery images are used.
- Confirm regional VM quotas, target capacity, image, network, identity, and Spot eviction behavior before deployment.
Best practices (3)
- Scope human fleet administration to the fleet resource group and keep the service-principal permissions for underlying resources separate.
- Use an allocation strategy and minimum capacity that match the workload tolerance for price, unavailable capacity, and Spot eviction.
- Review target capacity and fleet deletion behavior to prevent unexpected compute cost or orphaned running capacity.
Security considerations (3)
- A fleet can deploy up to thousands of VMs and therefore creates substantial cost, network, identity, and code-execution impact.
- The role has no DataActions, but changing images, VM profiles, identities, or network configuration can compromise every instance the fleet creates.
- The Azure Fleet resource provider permissions are separate assignments and should be limited to the underlying resource boundaries it needs.
Assignment guidance
Assign Compute Fleet Contributor to fleet administrators at the fleet resource group. Configure the Azure Fleet resource provider separately with only the documented underlying-resource roles and scopes, and avoid subscription-wide human assignment unless multiple resource groups must be administered.
Related roles (4)
- Virtual Machine Contributor: The Compute Fleet quickstart requires this companion subscription assignment for the Azure Fleet Resource Provider.
- Network Contributor: The Compute Fleet quickstart requires this companion subscription assignment for the Azure Fleet Resource Provider.
- Managed Identity Operator: The Compute Fleet quickstart requires this companion subscription assignment for the Azure Fleet Resource Provider.
- Compute Gallery Sharing Admin: The Compute Fleet quickstart requires this additional Azure Fleet Resource Provider assignment when the fleet uses images stored in Azure Compute Gallery.
Common questions
When should I assign the Compute Fleet Contributor Azure role?
Assign Compute Fleet Contributor when you need to: Create and manage a fleet that selects across approved VM sizes and allocation strategies for capacity or cost goals.; and Operate large stateless, batch, rendering, analytics, or CI workloads through a managed fleet definition.. Practical scope: Assign at the resource group that contains the fleet when possible; resource-group, subscription, and management-group assignments are inherited by child fleets. The role is control-plane only and has no DataActions, but a fleet can launch and maintain large numbers of Spot and standard VMs.
What permissions does the Compute Fleet Contributor Azure role grant?
The role definition grants 6 combined control-plane and data-plane actions. Representative operations include: Microsoft.AzureFleet/fleets/*; Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; Microsoft.ResourceHealth/availabilityStatuses/read; Microsoft.Resources/deployments/*; and Microsoft.Resources/subscriptions/resourceGroups/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Compute Fleet Contributor Azure role?
Key considerations when assigning Compute Fleet Contributor: A fleet can deploy up to thousands of VMs and therefore creates substantial cost, network, identity, and code-execution impact.; The role has no DataActions, but changing images, VM profiles, identities, or network configuration can compromise every instance the fleet creates.; and The Azure Fleet resource provider permissions are separate assignments and should be limited to the underlying resource boundaries it needs.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Compute →
Supports: Description, Practical scope. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Azure Compute Fleet overview →
Supports: Description, Practical scope, Common use cases, Best practices, Security considerations. Retrieved 2026-07-16.
- Create an Azure Compute Fleet using an ARM template →
Supports: Prerequisites, Assignment guidance, Related roles. Retrieved 2026-07-16.