Azure DevOps built-in role

DevOps Infrastructure Contributor

Creates, updates, reads, deletes, and performs service operations on Managed DevOps Pools. The published definition contains Azure control-plane Actions only and no DataActions; Azure DevOps organization, project, agent-pool, pipeline, and repository permissions remain separate.

Control-plane actions (10)

• Microsoft.DevOpsInfrastructure/register/action
• Microsoft.DevOpsInfrastructure/unregister/action
• Microsoft.DevOpsInfrastructure/*/read
• Microsoft.DevOpsInfrastructure/Locations/OperationStatuses/write
• Microsoft.DevOpsInfrastructure/pools/write
• Microsoft.DevOpsInfrastructure/pools/delete
• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the dedicated resource group containing Managed DevOps Pools when the resource providers are already registered, or at a broader subscription scope only when the principal must manage pools across that subscription or perform provider registration. Parent assignments are inherited.

Common use cases (2)

• Let a platform engineer create and manage Managed DevOps Pools without granting Contributor over unrelated Azure resource providers.
• Authorize a pipeline service connection identity to deploy and update Managed DevOps Pool resources after its separate Azure DevOps permissions are configured.

Prerequisites (2)

• Register Microsoft.DevOpsInfrastructure and Microsoft.DevCenter, verify regional VM-family quota, and have a dev center and project available.
• The principal must be a member of the Azure DevOps organization and each target project and have project-level agent-pool Administrator or Creator permission.

Best practices (3)

• Use this role instead of Contributor or Owner when the principal only manages Managed DevOps Pools.
• Assign Azure permissions and Azure DevOps project-level agent-pool permissions independently and review both planes.
• When a pool retrieves certificates, give its managed identity Key Vault Secrets User and give the configuration principal Key Vault Certificate User only on the required vault.

Security considerations (3)

• The role can create, reconfigure, and delete pools that execute Azure Pipelines jobs, affecting compute, network placement, images, cost, and pipeline availability.
• Azure RBAC alone does not authorize creation of the corresponding Azure DevOps agent pool or use of that pool by pipelines.
• Pool identities and provisioned certificates can reach resources outside the Managed DevOps Pool; those companion assignments and pipeline permissions determine the effective workload access.

Assignment guidance

Assign DevOps Infrastructure Contributor to the human or service-connection identity at the dedicated pool resource group. Add the documented Azure DevOps organization, project, and agent-pool permissions separately, and grant Key Vault or other workload access only to the pool identity that needs it.

Related roles (2)

• Contributor: Microsoft lists Contributor as a broader alternative that manages Managed DevOps Pools and unrelated Azure resources.
• Owner: Microsoft lists Owner as the broader alternative that also includes Azure role-assignment authority.

Editorial sources (7)

• Azure built-in roles for DevOps - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-17.

• Prerequisites for Managed DevOps Pools →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Configure Managed DevOps Pools security settings →

  Supports: Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

Official Microsoft Learn documentation →