Azure DevOps built-in role

Deployment Environments User

Creates, reads, redeploys, updates, and deletes the principal's own Azure Deployment Environments. Project discovery uses control-plane Actions, while the user environment lifecycle and output operations are DataActions; pool and schedule reads are excluded. Azure Deployment Environments is in maintenance mode: existing capabilities remain available and supported for current usage, but no new features are planned.

Control-plane actions (4)

• Microsoft.DevCenter/projects/read
• Microsoft.DevCenter/projects/*/read
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Authorization/*/read

Data-plane actions (5)

• Microsoft.DevCenter/projects/users/environments/userRead/action
• Microsoft.DevCenter/projects/users/environments/userWrite/action
• Microsoft.DevCenter/projects/users/environments/userDelete/action
• Microsoft.DevCenter/projects/users/environments/userActionManage/action
• Microsoft.DevCenter/projects/users/environments/userOutputsRead/action

Excluded actions (2)

• Microsoft.DevCenter/projects/pools/read
• Microsoft.DevCenter/projects/pools/schedules/read

Assignable scopes (1)

• /

Practical scope

Assign at a project to let a developer use every available project environment type, or at a specific project environment type to limit creation and management to that type. A role on the dev center is not inherited by its projects or environments.

Common use cases (2)

• For an existing Deployment Environments project, let developers create and manage their own development or test environments from approved catalog definitions.
• Limit current supported self-service usage to one environment type, such as sandbox or test, without granting access to other project environment types.

Prerequisites (3)

• The existing project must expose an approved catalog and a project environment type with a deployment identity and the creator or group roles to grant on deployed resources.
• The identity attached to the dev center, not the project environment-type deployment identity, should have Contributor and User Access Administrator on deployment subscriptions and Reader on subscriptions that contain relevant projects.
• When a user requests an environment, the service grants appropriate access to the separate deployment identity attached to the project environment type so that identity can perform the deployment on the user's behalf.

Best practices (4)

• Assign at an environment type when project-wide environment creation is unnecessary.
• Use different managed identities for the dev center and project environment types; Microsoft recommends that project identities have more limited resource access than dev-center identities.
• Keep repository permissions for GitHub or Azure Repos catalogs separate because Deployment Environments RBAC does not govern those repositories.
• Treat the assignment as access for current supported usage and do not plan around future Deployment Environments features, because no new features are planned.

Security considerations (3)

• The role gives the user full lifecycle control over environments they create, including deletion and redeployment.
• Access to Azure resources inside the environment is determined separately by creator and group roles configured on the project environment type.
• The dev-center identity carries the standing Contributor and User Access Administrator subscription assignments. The project environment-type deployment identity is a different principal that performs deployments with access granted by the service; review and limit both identities independently.

Assignment guidance

For an existing deployment, assign Deployment Environments User to a developer group at the project or specific environment-type scope. Configure the dev-center identity's documented subscription roles separately, attach a narrower deployment identity and resource roles to the project environment type, and use Reader when only visibility is required. No new Deployment Environments features are planned.

Related roles (2)

• Deployment Environments Reader: Provides project and environment visibility without the user environment lifecycle DataActions.
• DevCenter Project Admin: Manages all environments and environment types in the project instead of only the assignee's environments.

Editorial sources (8)

• Azure built-in roles for DevOps - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-17.

• Plan Azure Role-Based Access Control - Azure Deployment Environments | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Configure a managed identity for Azure Deployment Environments - Azure Deployment Environments | Microsoft Learn →

  Supports: Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Azure Deployment Environments - maintenance mode - Azure Deployment Environments | Microsoft Learn →

  Supports: Description, Common use cases, Best practices, Assignment guidance. Retrieved 2026-07-17.

Official Microsoft Learn documentation →