Azure DevOps built-in role

DevCenter Project Admin

Administers Microsoft Dev Box and Azure Deployment Environments resources within a project without creating or deleting the project itself. It combines project control-plane Actions with administrative DataActions over user dev boxes and deployment environments. For Microsoft Dev Box, this is existing-usage administration: no additional Dev Box features are planned, and Microsoft recommends Windows 365 as the path forward for virtualized developer environments.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: 331c37c6-af14-46d9-b9f4-e1909e1b95a0

Control-plane actions (4)

Data-plane actions (27)

Excluded actions (2)

Assignable scopes (1)

Practical scope

Assign at a project for all project pools, dev boxes, environment types, and environments. Deployment Environments also supports assignment on a specific project environment type for a narrower admin boundary; permissions assigned at a dev center are not inherited by its projects.

Common use cases (2)

Prerequisites (2)

Best practices (4)

Security considerations (3)

Assignment guidance

For current supported usage, assign DevCenter Project Admin to the dev manager on the project, or on a specific Deployment Environments environment type when that narrower boundary is sufficient. Use Dev Box User and Deployment Environments User for self-service users, keep dev-center ownership separate, and include the Windows 365 path forward in Dev Box planning.

Related roles (3)

Common questions

When should I assign the DevCenter Project Admin Azure role?

Assign DevCenter Project Admin when you need to: For an existing Dev Box project, let a dev manager create and manage pools and start, stop, or delete dev boxes across users in that project.; and Let a dev manager manage all deployment environments and environment types, including project catalogs and environment expiry settings, for one project.. Practical scope: Assign at a project for all project pools, dev boxes, environment types, and environments. Deployment Environments also supports assignment on a specific project environment type for a narrower admin boundary; permissions assigned at a dev center are not inherited by its projects.

What permissions does the DevCenter Project Admin Azure role grant?

The role definition grants 31 combined control-plane and data-plane actions. Representative operations include: Microsoft.DevCenter/projects/*; Microsoft.Authorization/*/read; Microsoft.Resources/deployments/*; Microsoft.Resources/subscriptions/resourceGroups/read; Microsoft.DevCenter/projects/users/devboxes/adminStart/action; and Microsoft.DevCenter/projects/users/devboxes/adminStop/action. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the DevCenter Project Admin Azure role?

Key considerations when assigning DevCenter Project Admin: Administrative DataActions can start, stop, update, or delete other users' dev boxes and can update, redeploy, or delete environments across the assigned project.; The role can manage project pools and catalogs but cannot create or delete the project itself.; and Repository permissions for GitHub or Azure Repos catalogs remain separate and can expand the administrator's effective ability to change environment or customization content.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (8)

Official Microsoft Learn documentation →