Azure DevOps built-in role

Deployment Environments User

Creates, reads, redeploys, updates, and deletes the principal's own Azure Deployment Environments. Project discovery uses control-plane Actions, while the user environment lifecycle and output operations are DataActions; pool and schedule reads are excluded. Azure Deployment Environments is in maintenance mode: existing capabilities remain available and supported for current usage, but no new features are planned.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: 18e40d4e-8d2e-438d-97e1-9528336e149c

Control-plane actions (4)

Data-plane actions (5)

Excluded actions (2)

Assignable scopes (1)

Practical scope

Assign at a project to let a developer use every available project environment type, or at a specific project environment type to limit creation and management to that type. A role on the dev center is not inherited by its projects or environments.

Common use cases (2)

Prerequisites (3)

Best practices (4)

Security considerations (3)

Assignment guidance

For an existing deployment, assign Deployment Environments User to a developer group at the project or specific environment-type scope. Configure the dev-center identity's documented subscription roles separately, attach a narrower deployment identity and resource roles to the project environment type, and use Reader when only visibility is required. No new Deployment Environments features are planned.

Related roles (2)

Common questions

When should I assign the Deployment Environments User Azure role?

Assign Deployment Environments User when you need to: For an existing Deployment Environments project, let developers create and manage their own development or test environments from approved catalog definitions.; and Limit current supported self-service usage to one environment type, such as sandbox or test, without granting access to other project environment types.. Practical scope: Assign at a project to let a developer use every available project environment type, or at a specific project environment type to limit creation and management to that type. A role on the dev center is not inherited by its projects or environments.

What permissions does the Deployment Environments User Azure role grant?

The role definition grants 9 combined control-plane and data-plane actions. Representative operations include: Microsoft.DevCenter/projects/read; Microsoft.DevCenter/projects/*/read; Microsoft.Resources/subscriptions/resourceGroups/read; Microsoft.Authorization/*/read; Microsoft.DevCenter/projects/users/environments/userRead/action; and Microsoft.DevCenter/projects/users/environments/userWrite/action. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Deployment Environments User Azure role?

Key considerations when assigning Deployment Environments User: The role gives the user full lifecycle control over environments they create, including deletion and redeployment.; Access to Azure resources inside the environment is determined separately by creator and group roles configured on the project environment type.; and The dev-center identity carries the standing Contributor and User Access Administrator subscription assignments. The project environment-type deployment identity is a different principal that performs deployments with access granted by the service; review and limit both identities independently.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (8)

Official Microsoft Learn documentation →