Azure Analytics built-in role
Data Factory Contributor
Creates, edits, and deletes Azure Data Factory factories and child resources, deploys Resource Manager templates, manages Application Insights alerts for a factory, and creates support tickets. The published definition grants control-plane Actions and no DataActions; Azure Repos and GitHub permissions remain separate from Data Factory permissions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 673868aa-7521-48a0-acc6-0f60742d39f5
Control-plane actions (9)
Microsoft.Authorization/*/readMicrosoft.DataFactory/dataFactories/*Microsoft.DataFactory/factories/*Microsoft.Insights/alertRules/*Microsoft.ResourceHealth/availabilityStatuses/readMicrosoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.Support/*Microsoft.EventGrid/eventSubscriptions/write
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
For Data Factory portal management of datasets, linked services, pipelines, triggers, and integration runtimes, Microsoft documents Data Factory Contributor at resource-group scope or above. A resource-group assignment is inherited by every factory in that group, while subscription scope extends the same authority to all inherited resource groups and factories.
Common use cases (2)
- Create and manage data factories and their child resources through the Data Factory portal.
- Publish Data Factory resources by deploying Resource Manager templates within an approved resource group.
Prerequisites (2)
- The principal must have Data Factory Contributor or Contributor at resource-group scope or above for the documented portal authoring and publishing workflow.
- For a Git-backed factory, grant Azure Repos or GitHub permissions separately because repository authorization is independent of Azure Data Factory authorization.
Best practices (3)
- Use Reader when a user only needs to view and monitor a factory, and use a documented custom-role pattern when access must be limited to one factory or a smaller set of operations.
- Do not add Data Factory Contributor when the principal already has Contributor at resource-group scope or above, because Microsoft documents Contributor as a superset.
- Keep the assignment at the smallest resource group containing all factories the principal is expected to publish.
Security considerations (3)
- The role can create, change, and delete factories and their child resources and can deploy Resource Manager templates within its assigned scope.
- A Resource Manager deployment does not elevate the principal; a template operation fails when the principal lacks permission to create the requested resource type.
- Repository permissions are independent of Data Factory permissions. In the documented Git-backed workflow, a user with repository permissions and Reader on the factory can edit child resources and commit changes, but cannot publish those changes.
Assignment guidance
Assign Data Factory Contributor on the resource group that contains the approved factories when the principal must author and publish Data Factory resources. Use Reader for view and monitor duties; for one-factory editing, follow the documented Contributor-at-factory plus custom deployment-role pattern instead of broadening Data Factory Contributor.
Related roles (2)
- Contributor: Microsoft documents Contributor at resource-group scope or above as a superset that already includes Data Factory Contributor permissions.
- Reader: Microsoft documents Reader on a data factory for users who should view and monitor it without editing or publishing it.
Common questions
When should I assign the Data Factory Contributor Azure role?
Assign Data Factory Contributor when you need to: Create and manage data factories and their child resources through the Data Factory portal.; and Publish Data Factory resources by deploying Resource Manager templates within an approved resource group.. Practical scope: For Data Factory portal management of datasets, linked services, pipelines, triggers, and integration runtimes, Microsoft documents Data Factory Contributor at resource-group scope or above. A resource-group assignment is inherited by every factory in that group, while subscription scope extends the same authority to all inherited resource groups and factories.
What permissions does the Data Factory Contributor Azure role grant?
The role definition grants 9 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.DataFactory/dataFactories/*; Microsoft.DataFactory/factories/*; Microsoft.Insights/alertRules/*; Microsoft.ResourceHealth/availabilityStatuses/read; and Microsoft.Resources/deployments/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Data Factory Contributor Azure role?
Key considerations when assigning Data Factory Contributor: The role can create, change, and delete factories and their child resources and can deploy Resource Manager templates within its assigned scope.; A Resource Manager deployment does not elevate the principal; a template operation fails when the principal lacks permission to create the requested resource type.; and Repository permissions are independent of Data Factory permissions. In the documented Git-backed workflow, a user with repository permissions and Reader on the factory can edit child resources and commit changes, but cannot publish those changes.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Analytics →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Roles and permissions for Azure Data Factory →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.