Azure DevOps built-in role

DevCenter Dev Box User

Creates and manages the assignee's own Microsoft Dev Box resources. Project and pool discovery use control-plane Actions, while create, start, stop, connect, schedule-management, and delete operations on the user's dev boxes are DataActions. Microsoft Dev Box is in maintenance mode with no additional features planned; it remains supported for existing usage, while Microsoft recommends Windows 365 as the path forward for virtualized developer environments.

Control-plane actions (4)

• Microsoft.DevCenter/projects/read
• Microsoft.DevCenter/projects/*/read
• Microsoft.Authorization/*/read
• Microsoft.Resources/subscriptions/resourceGroups/read

Data-plane actions (11)

• Microsoft.DevCenter/projects/users/devboxes/userStop/action
• Microsoft.DevCenter/projects/users/devboxes/userStart/action
• Microsoft.DevCenter/projects/users/devboxes/userGetRemoteConnection/action
• Microsoft.DevCenter/projects/users/devboxes/userRead/action
• Microsoft.DevCenter/projects/users/devboxes/userWrite/action
• Microsoft.DevCenter/projects/users/devboxes/userDelete/action
• Microsoft.DevCenter/projects/users/devboxes/userUpcomingActionRead/action
• Microsoft.DevCenter/projects/users/devboxes/userUpcomingActionManage/action
• Microsoft.DevCenter/projects/users/devboxes/userActionRead/action
• Microsoft.DevCenter/projects/users/devboxes/userActionManage/action
• Microsoft.DevCenter/projects/users/devboxes/userCustomize/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign at the Microsoft Dev Box project. The assignment grants access to the project and its available pools; a role assigned on the dev center itself is not inherited by projects, pools, definitions, or dev boxes.

Common use cases (2)

• For an existing Dev Box project, let developers create dev boxes from approved pools and manage the dev boxes they create through the developer portal.
• Allow a project member to connect, start, stop, restart, delay scheduled shutdown, or delete the member's own dev boxes.

Prerequisites (2)

• A dev center, project, and at least one configured dev box pool must exist.
• The principal must be a Microsoft Entra user or group selected for access to the specific project.

Best practices (4)

• Assign to developer groups at project scope instead of using resource-group or subscription assignments.
• Separate projects by team and place pools close to their users to limit access and latency.
• Keep catalog repository permissions in GitHub or Azure Repos separate from the Dev Box role assignment.
• Use the role for current supported Dev Box usage while planning the recommended path forward in Windows 365 rather than depending on new Dev Box features.

Security considerations (3)

• The role can obtain remote connection information and gives the user full lifecycle control over dev boxes the user creates.
• A project assignment exposes every pool available in that project and allows creation from any pool the project presents.
• The role does not grant platform management of dev centers, definitions, network connections, or other users' dev boxes.

Assignment guidance

For current supported Dev Box usage, assign DevCenter Dev Box User to the developer group on the specific project. Use separate projects to isolate teams, reserve DevCenter Project Admin for managers who configure pools or administer dev boxes across users, and include the Windows 365 path forward in platform planning.

Related roles (2)

• DevCenter Project Admin: Creates project pools and can start, stop, or delete dev boxes across users in the project.
• DevCenter Owner: Manages DevCenter resources and can delegate the Dev Box User role at project scope.

Editorial sources (7)

• Azure built-in roles for DevOps - Azure RBAC | Microsoft Learn →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-17.

• Plan Azure role-based access control - Microsoft Dev Box | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Microsoft Dev Box for Cloud-Based Development - Microsoft Dev Box | Microsoft Learn →

  Supports: Description, Common use cases, Best practices, Assignment guidance. Retrieved 2026-07-17.

Official Microsoft Learn documentation →