Azure DevOps built-in role

DevTest Labs User

Lets a DevTest Labs member view lab resources and policies and create or modify the member's own VMs and environments within lab policy limits. The role uses control-plane Actions only and has no DataActions; users automatically receive Owner permissions on VMs they create or claim.

Control-plane actions (32)

• Microsoft.Authorization/*/read
• Microsoft.Compute/availabilitySets/read
• Microsoft.Compute/virtualMachines/*/read
• Microsoft.Compute/virtualMachines/deallocate/action
• Microsoft.Compute/virtualMachines/read
• Microsoft.Compute/virtualMachines/restart/action
• Microsoft.Compute/virtualMachines/start/action
• Microsoft.DevTestLab/*/read
• Microsoft.DevTestLab/labs/claimAnyVm/action
• Microsoft.DevTestLab/labs/createEnvironment/action
• Microsoft.DevTestLab/labs/ensureCurrentUserProfile/action
• Microsoft.DevTestLab/labs/formulas/delete
• Microsoft.DevTestLab/labs/formulas/read
• Microsoft.DevTestLab/labs/formulas/write
• Microsoft.DevTestLab/labs/policySets/evaluatePolicies/action
• Microsoft.DevTestLab/labs/virtualMachines/claim/action
• Microsoft.DevTestLab/labs/virtualmachines/listApplicableSchedules/action
• Microsoft.DevTestLab/labs/virtualMachines/getRdpFileContents/action
• Microsoft.Network/loadBalancers/backendAddressPools/join/action
• Microsoft.Network/loadBalancers/inboundNatRules/join/action
• Microsoft.Network/networkInterfaces/*/read
• Microsoft.Network/networkInterfaces/join/action
• Microsoft.Network/networkInterfaces/read
• Microsoft.Network/networkInterfaces/write
• Microsoft.Network/publicIPAddresses/*/read
• Microsoft.Network/publicIPAddresses/join/action
• Microsoft.Network/publicIPAddresses/read
• Microsoft.Network/virtualNetworks/subnets/join/action
• Microsoft.Resources/deployments/operations/read
• Microsoft.Resources/deployments/read
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Storage/storageAccounts/listKeys/action

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (1)

• Microsoft.Compute/virtualMachines/vmSizes/read

Assignable scopes (1)

• /

Practical scope

Assign on the individual DevTest Labs lab. Resource-group or subscription assignments are inherited more broadly and can make the role's VM, network, deployment, and storage-key Actions effective against additional resources in scope.

Common use cases (2)

• Allow a developer or tester to create, claim, connect to, start, restart, stop, and customize the user's own lab VMs.
• Let a lab member create the member's own template-based environments while remaining subject to lab policies and quotas.

Prerequisites (2)

• A lab owner must configure the policies, images, sizes, networks, artifacts, templates, and other settings required by the intended workflow; a claimable VM pool is required only when users will claim precreated VMs.
• The user needs the lab URL and the username and password for the VM being accessed, or another approved connection method documented for that VM.

Best practices (3)

• Assign directly on the lab and use policies for per-user VM count, allowed sizes, and automatic shutdown to control cost and waste.
• Store secrets in Azure Key Vault rather than embedding credentials in code, templates, artifacts, or configuration files.
• Use a custom role when a lab member needs a smaller policy or VM-operation boundary than the built-in user role.

Security considerations (4)

• Users become Owner of VMs they create or claim, giving them control over those VM resources beyond basic start and stop operations.
• The published definition includes Microsoft.Storage/storageAccounts/listKeys/action. If the assignment scope includes a storage account, that operation returns its access keys; Microsoft documents that a shared key grants full access to the storage account data and the ability to generate SAS tokens.
• The definition also includes network join Actions, so a parent-scope assignment can make storage-key and network operations effective outside one lab.
• The role cannot change lab policies or other users' VMs unless separate access is granted.

Assignment guidance

Assign DevTest Labs User directly on the approved lab to developer or tester groups. Configure restrictive lab policies first, keep secrets in Key Vault, and avoid resource-group or subscription scope unless every inherited resource is intentionally included.

Related roles (2)

• Contributor: Microsoft documents lab Contributor as able to configure labs and policies but unable to assign or manage lab users and roles.
• Owner: Microsoft documents lab Owner as the role that can manage every lab task, including users and role assignments.

Editorial sources (9)

• Azure built-in roles for DevOps - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-17.

• Azure DevTest Labs concepts - Azure DevTest Labs | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Azure security baseline for Azure DevTest Labs | Microsoft Learn →

  Supports: Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Manage account access keys - Azure Storage | Microsoft Learn →

  Supports: Security considerations. Retrieved 2026-07-17.

• Access, claim, and connect to a DevTest Labs VM - Azure DevTest Labs | Microsoft Learn →

  Supports: Common use cases, Prerequisites. Retrieved 2026-07-17.

Official Microsoft Learn documentation →