Azure Analytics built-in role

Data Factory Contributor

Creates, edits, and deletes Azure Data Factory factories and child resources, deploys Resource Manager templates, manages Application Insights alerts for a factory, and creates support tickets. The published definition grants control-plane Actions and no DataActions; Azure Repos and GitHub permissions remain separate from Data Factory permissions.

Control-plane actions (9)

• Microsoft.Authorization/*/read
• Microsoft.DataFactory/dataFactories/*
• Microsoft.DataFactory/factories/*
• Microsoft.Insights/alertRules/*
• Microsoft.ResourceHealth/availabilityStatuses/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Support/*
• Microsoft.EventGrid/eventSubscriptions/write

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

For Data Factory portal management of datasets, linked services, pipelines, triggers, and integration runtimes, Microsoft documents Data Factory Contributor at resource-group scope or above. A resource-group assignment is inherited by every factory in that group, while subscription scope extends the same authority to all inherited resource groups and factories.

Common use cases (2)

• Create and manage data factories and their child resources through the Data Factory portal.
• Publish Data Factory resources by deploying Resource Manager templates within an approved resource group.

Prerequisites (2)

• The principal must have Data Factory Contributor or Contributor at resource-group scope or above for the documented portal authoring and publishing workflow.
• For a Git-backed factory, grant Azure Repos or GitHub permissions separately because repository authorization is independent of Azure Data Factory authorization.

Best practices (3)

• Use Reader when a user only needs to view and monitor a factory, and use a documented custom-role pattern when access must be limited to one factory or a smaller set of operations.
• Do not add Data Factory Contributor when the principal already has Contributor at resource-group scope or above, because Microsoft documents Contributor as a superset.
• Keep the assignment at the smallest resource group containing all factories the principal is expected to publish.

Security considerations (3)

• The role can create, change, and delete factories and their child resources and can deploy Resource Manager templates within its assigned scope.
• A Resource Manager deployment does not elevate the principal; a template operation fails when the principal lacks permission to create the requested resource type.
• Repository permissions are independent of Data Factory permissions. In the documented Git-backed workflow, a user with repository permissions and Reader on the factory can edit child resources and commit changes, but cannot publish those changes.

Assignment guidance

Assign Data Factory Contributor on the resource group that contains the approved factories when the principal must author and publish Data Factory resources. Use Reader for view and monitor duties; for one-factory editing, follow the documented Contributor-at-factory plus custom deployment-role pattern instead of broadening Data Factory Contributor.

Related roles (2)

• Contributor: Microsoft documents Contributor at resource-group scope or above as a superset that already includes Data Factory Contributor permissions.
• Reader: Microsoft documents Reader on a data factory for users who should view and monitor it without editing or publishing it.

Editorial sources (6)

• Azure built-in roles for Analytics →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Roles and permissions for Azure Data Factory →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →