Azure DevOps built-in role
DevOps Infrastructure Contributor
Creates, updates, reads, deletes, and performs service operations on Managed DevOps Pools. The published definition contains Azure control-plane Actions only and no DataActions; Azure DevOps organization, project, agent-pool, pipeline, and repository permissions remain separate.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 76153a9e-0edb-49bc-8e01-93c47e6b5180
Control-plane actions (10)
Microsoft.DevOpsInfrastructure/register/actionMicrosoft.DevOpsInfrastructure/unregister/actionMicrosoft.DevOpsInfrastructure/*/readMicrosoft.DevOpsInfrastructure/Locations/OperationStatuses/writeMicrosoft.DevOpsInfrastructure/pools/writeMicrosoft.DevOpsInfrastructure/pools/deleteMicrosoft.Authorization/*/readMicrosoft.Insights/alertRules/*Microsoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the dedicated resource group containing Managed DevOps Pools when the resource providers are already registered, or at a broader subscription scope only when the principal must manage pools across that subscription or perform provider registration. Parent assignments are inherited.
Common use cases (2)
- Let a platform engineer create and manage Managed DevOps Pools without granting Contributor over unrelated Azure resource providers.
- Authorize a pipeline service connection identity to deploy and update Managed DevOps Pool resources after its separate Azure DevOps permissions are configured.
Prerequisites (2)
- Register Microsoft.DevOpsInfrastructure and Microsoft.DevCenter, verify regional VM-family quota, and have a dev center and project available.
- The principal must be a member of the Azure DevOps organization and each target project and have project-level agent-pool Administrator or Creator permission.
Best practices (3)
- Use this role instead of Contributor or Owner when the principal only manages Managed DevOps Pools.
- Assign Azure permissions and Azure DevOps project-level agent-pool permissions independently and review both planes.
- When a pool retrieves certificates, give its managed identity Key Vault Secrets User and give the configuration principal Key Vault Certificate User only on the required vault.
Security considerations (3)
- The role can create, reconfigure, and delete pools that execute Azure Pipelines jobs, affecting compute, network placement, images, cost, and pipeline availability.
- Azure RBAC alone does not authorize creation of the corresponding Azure DevOps agent pool or use of that pool by pipelines.
- Pool identities and provisioned certificates can reach resources outside the Managed DevOps Pool; those companion assignments and pipeline permissions determine the effective workload access.
Assignment guidance
Assign DevOps Infrastructure Contributor to the human or service-connection identity at the dedicated pool resource group. Add the documented Azure DevOps organization, project, and agent-pool permissions separately, and grant Key Vault or other workload access only to the pool identity that needs it.
Related roles (2)
- Contributor: Microsoft lists Contributor as a broader alternative that manages Managed DevOps Pools and unrelated Azure resources.
- Owner: Microsoft lists Owner as the broader alternative that also includes Azure role-assignment authority.
Common questions
When should I assign the DevOps Infrastructure Contributor Azure role?
Assign DevOps Infrastructure Contributor when you need to: Let a platform engineer create and manage Managed DevOps Pools without granting Contributor over unrelated Azure resource providers.; and Authorize a pipeline service connection identity to deploy and update Managed DevOps Pool resources after its separate Azure DevOps permissions are configured.. Practical scope: Assign on the dedicated resource group containing Managed DevOps Pools when the resource providers are already registered, or at a broader subscription scope only when the principal must manage pools across that subscription or perform provider registration. Parent assignments are inherited.
What permissions does the DevOps Infrastructure Contributor Azure role grant?
The role definition grants 10 combined control-plane and data-plane actions. Representative operations include: Microsoft.DevOpsInfrastructure/register/action; Microsoft.DevOpsInfrastructure/unregister/action; Microsoft.DevOpsInfrastructure/*/read; Microsoft.DevOpsInfrastructure/Locations/OperationStatuses/write; Microsoft.DevOpsInfrastructure/pools/write; and Microsoft.DevOpsInfrastructure/pools/delete. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the DevOps Infrastructure Contributor Azure role?
Key considerations when assigning DevOps Infrastructure Contributor: The role can create, reconfigure, and delete pools that execute Azure Pipelines jobs, affecting compute, network placement, images, cost, and pipeline availability.; Azure RBAC alone does not authorize creation of the corresponding Azure DevOps agent pool or use of that pool by pipelines.; and Pool identities and provisioned certificates can reach resources outside the Managed DevOps Pool; those companion assignments and pipeline permissions determine the effective workload access.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for DevOps - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-17.
- Prerequisites for Managed DevOps Pools →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Configure Managed DevOps Pools security settings →
Supports: Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.