Azure Privileged built-in role
Contributor
Manages Azure resources of every type at the assigned scope, but cannot create or delete Azure RBAC role assignments and has other exclusions published in the built-in definition. It is a broad privileged administrator role, not a least-privilege default.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: b24988ac-6180-42a0-ab88-20f7382dd24c
Control-plane actions (1)
*
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (11)
Microsoft.Authorization/*/DeleteMicrosoft.Authorization/*/WriteMicrosoft.Authorization/elevateAccess/ActionMicrosoft.Blueprint/blueprintAssignments/writeMicrosoft.Blueprint/blueprintAssignments/deleteMicrosoft.Compute/galleries/share/actionMicrosoft.Purview/consents/writeMicrosoft.Purview/consents/deleteMicrosoft.Resources/deploymentStacks/manageDenySetting/actionMicrosoft.Subscription/cancel/actionMicrosoft.Subscription/enable/action
Assignable scopes (1)
/
Practical scope
The built-in definition is available throughout the Azure hierarchy. The assignment applies only at the selected management group, subscription, resource group, or resource, then is inherited by child scopes. Its wildcard is in the control plane; the role has no DataActions and does not itself grant Azure RBAC data-plane access.
Common use cases (2)
- Manage all resource types inside a tightly bounded resource group when service-specific job-function roles do not cover the required work.
- Run deployment or operations automation that must create, update, and delete heterogeneous Azure resources without delegating Azure RBAC access.
Prerequisites (2)
- Identify the user, group, service principal, or managed identity that needs access and the narrowest scope that contains its work.
- The assigning administrator needs Microsoft.Authorization/roleAssignments/write at that scope.
Best practices (3)
- Start with a service-specific job-function role and use Contributor only when those narrower roles are insufficient.
- Assign at the smallest practical scope; a parent-scope assignment is inherited by every child scope.
- For human administrators, use an eligible or time-bound PIM assignment when the tenant has the required license and workflow.
Security considerations (3)
- Contributor can change or delete resources of all types in scope even though it cannot assign Azure RBAC roles.
- The wildcard control-plane grant can cover new resource-provider actions over time; review broad assignments regularly.
- No DataActions are present, but management-plane authority is still highly privileged and must not be treated as read-only or low risk.
Assignment guidance
Use Contributor only after confirming that a narrower job-function role cannot meet the task. Prefer a group over direct user assignments, keep the scope narrow, use the immutable role definition ID in automation, and use PIM for eligible human access where available.
Related roles (2)
- Owner: Adds Azure RBAC role-assignment authority to broad resource management.
- Reader: Read-only control-plane alternative when resource changes are not required.
Common questions
When should I assign the Contributor Azure role?
Assign Contributor when you need to: Manage all resource types inside a tightly bounded resource group when service-specific job-function roles do not cover the required work.; and Run deployment or operations automation that must create, update, and delete heterogeneous Azure resources without delegating Azure RBAC access.. Practical scope: The built-in definition is available throughout the Azure hierarchy. The assignment applies only at the selected management group, subscription, resource group, or resource, then is inherited by child scopes. Its wildcard is in the control plane; the role has no DataActions and does not itself grant Azure RBAC data-plane access.
What permissions does the Contributor Azure role grant?
The role definition grants 1 combined control-plane and data-plane actions. Representative operations include: *. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Contributor Azure role?
Key considerations when assigning Contributor: Contributor can change or delete resources of all types in scope even though it cannot assign Azure RBAC roles.; The wildcard control-plane grant can cover new resource-provider actions over time; review broad assignments regularly.; and No DataActions are present, but management-plane authority is still highly privileged and must not be treated as read-only or low risk.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for Privileged →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.
- Eligible and time-bound role assignments in Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.