Azure DevOps built-in role

Deployment Environments Reader

Provides read-only visibility into Azure Deployment Environments project and environment resources. Its project reads are control-plane Actions, while environment administration and output reads are DataActions; pool and pool-schedule reads are excluded. Azure Deployment Environments is in maintenance mode: existing capabilities remain available and supported for current usage, but no new features are planned.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: eb960402-bf75-4cc3-8d68-35b34f960f72

Control-plane actions (4)

Data-plane actions (3)

Excluded actions (2)

Assignable scopes (1)

Practical scope

Assign at a project to view all of its environment types and environments, or at one project environment type to limit visibility to that type. Permissions assigned on the dev center itself are not inherited by projects or deployment environments.

Common use cases (2)

Prerequisites (2)

Best practices (4)

Security considerations (3)

Assignment guidance

For an existing deployment, assign Deployment Environments Reader on the project for project-wide visibility or on a specific project environment type for a smaller boundary. Use Deployment Environments User only for developers who create and manage their own environments, and plan with the service's maintenance-mode status in mind.

Related roles (2)

Common questions

When should I assign the Deployment Environments Reader Azure role?

Assign Deployment Environments Reader when you need to: For an existing Deployment Environments project, let a developer, service principal, or dev manager view environments created by any user without creating, redeploying, or deleting them.; and Give an auditor current supported visibility into one project or one environment type while keeping environment management separate.. Practical scope: Assign at a project to view all of its environment types and environments, or at one project environment type to limit visibility to that type. Permissions assigned on the dev center itself are not inherited by projects or deployment environments.

What permissions does the Deployment Environments Reader Azure role grant?

The role definition grants 7 combined control-plane and data-plane actions. Representative operations include: Microsoft.DevCenter/projects/read; Microsoft.DevCenter/projects/*/read; Microsoft.Authorization/*/read; Microsoft.Resources/subscriptions/resourceGroups/read; Microsoft.DevCenter/projects/users/environments/adminRead/action; and Microsoft.DevCenter/projects/users/environments/adminActionRead/action. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Deployment Environments Reader Azure role?

Key considerations when assigning Deployment Environments Reader: The DataActions expose environment records and deployment outputs throughout the assigned project or environment type.; The role does not grant permission to modify environment resources or automatically authorize access to the Azure resources deployed inside an environment.; and A project-level assignment is broader than an environment-type assignment and covers environments created by other users.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (7)

Official Microsoft Learn documentation →