Azure DevOps built-in role

DevCenter Owner

Manages Microsoft.DevCenter resources and has conditional Azure role-assignment authority limited to DevCenter Project Admin and DevCenter Dev Box User role definitions. The published role contains control-plane Actions only and no DataActions. For Microsoft Dev Box, this is existing-usage administration: no additional Dev Box features are planned, and Microsoft recommends Windows 365 as the path forward for virtualized developer environments.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: 4c6569b6-f23e-4295-9b90-bd4cc4ff3292

Control-plane actions (6)

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Conditions (1)

Assignable scopes (1)

Practical scope

At resource-group scope, the role can create and manage DevCenter resources in that group. At dev-center scope, it manages that center and its projects, pools, definitions, catalogs, connections, and galleries but cannot create another dev center. Dev-center assignments are not inherited as generic permissions on separate project or dev-box resources.

Common use cases (2)

Prerequisites (2)

Best practices (4)

Security considerations (3)

Assignment guidance

Assign DevCenter Owner at an existing dev center when the platform engineer manages only that center, or at a dedicated resource group only when the engineer must create or manage all DevCenter resources there. Keep project user and admin assignments explicit, rely on the built-in condition rather than describing this role as general access delegation, and include the Windows 365 path forward in Dev Box planning.

Related roles (3)

Common questions

When should I assign the DevCenter Owner Azure role?

Assign DevCenter Owner when you need to: Delegate administration of one dev center without granting Contributor or Owner over unrelated resource types in its resource group.; and Administer existing Dev Box or Deployment Environments projects and delegate approved project-admin and Dev Box user access.. Practical scope: At resource-group scope, the role can create and manage DevCenter resources in that group. At dev-center scope, it manages that center and its projects, pools, definitions, catalogs, connections, and galleries but cannot create another dev center. Dev-center assignments are not inherited as generic permissions on separate project or dev-box resources.

What permissions does the DevCenter Owner Azure role grant?

The role definition grants 6 combined control-plane and data-plane actions. Representative operations include: Microsoft.DevCenter/*; Microsoft.Authorization/*/read; Microsoft.Authorization/roleAssignments/write; Microsoft.Authorization/roleAssignments/delete; Microsoft.Resources/deployments/*; and Microsoft.Resources/subscriptions/resourceGroups/read. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the DevCenter Owner Azure role?

Key considerations when assigning DevCenter Owner: The role can create, update, and delete a broad set of Microsoft.DevCenter resources and alter catalogs, connections, galleries, projects, definitions, and pools.; Its role-assignment write and delete Actions are constrained to the DevCenter Project Admin and DevCenter Dev Box User role-definition IDs rather than arbitrary Azure roles.; and A resource-group assignment reaches every Microsoft.DevCenter resource in the group and also permits creation of new dev centers there.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (8)

Official Microsoft Learn documentation →