Azure Privileged built-in role

Contributor

Manages Azure resources of every type at the assigned scope, but cannot create or delete Azure RBAC role assignments and has other exclusions published in the built-in definition. It is a broad privileged administrator role, not a least-privilege default.

Control-plane actions (1)

• *

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (11)

• Microsoft.Authorization/*/Delete
• Microsoft.Authorization/*/Write
• Microsoft.Authorization/elevateAccess/Action
• Microsoft.Blueprint/blueprintAssignments/write
• Microsoft.Blueprint/blueprintAssignments/delete
• Microsoft.Compute/galleries/share/action
• Microsoft.Purview/consents/write
• Microsoft.Purview/consents/delete
• Microsoft.Resources/deploymentStacks/manageDenySetting/action
• Microsoft.Subscription/cancel/action
• Microsoft.Subscription/enable/action

Assignable scopes (1)

• /

Practical scope

The built-in definition is available throughout the Azure hierarchy. The assignment applies only at the selected management group, subscription, resource group, or resource, then is inherited by child scopes. Its wildcard is in the control plane; the role has no DataActions and does not itself grant Azure RBAC data-plane access.

Common use cases (2)

• Manage all resource types inside a tightly bounded resource group when service-specific job-function roles do not cover the required work.
• Run deployment or operations automation that must create, update, and delete heterogeneous Azure resources without delegating Azure RBAC access.

Prerequisites (2)

• Identify the user, group, service principal, or managed identity that needs access and the narrowest scope that contains its work.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at that scope.

Best practices (3)

• Start with a service-specific job-function role and use Contributor only when those narrower roles are insufficient.
• Assign at the smallest practical scope; a parent-scope assignment is inherited by every child scope.
• For human administrators, use an eligible or time-bound PIM assignment when the tenant has the required license and workflow.

Security considerations (3)

• Contributor can change or delete resources of all types in scope even though it cannot assign Azure RBAC roles.
• The wildcard control-plane grant can cover new resource-provider actions over time; review broad assignments regularly.
• No DataActions are present, but management-plane authority is still highly privileged and must not be treated as read-only or low risk.

Assignment guidance

Use Contributor only after confirming that a narrower job-function role cannot meet the task. Prefer a group over direct user assignments, keep the scope narrow, use the immutable role definition ID in automation, and use PIM for eligible human access where available.

Related roles (2)

• Owner: Adds Azure RBAC role-assignment authority to broad resource management.
• Reader: Read-only control-plane alternative when resource changes are not required.

Editorial sources (5)

• Azure built-in roles for Privileged →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• Eligible and time-bound role assignments in Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

Official Microsoft Learn documentation →