Azure DevOps built-in role

DevTest Labs User

Lets a DevTest Labs member view lab resources and policies and create or modify the member's own VMs and environments within lab policy limits. The role uses control-plane Actions only and has no DataActions; users automatically receive Owner permissions on VMs they create or claim.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: 76283e04-6283-4c54-8f91-bcf1374a3c64

Control-plane actions (32)

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (1)

Assignable scopes (1)

Practical scope

Assign on the individual DevTest Labs lab. Resource-group or subscription assignments are inherited more broadly and can make the role's VM, network, deployment, and storage-key Actions effective against additional resources in scope.

Common use cases (2)

Prerequisites (2)

Best practices (3)

Security considerations (4)

Assignment guidance

Assign DevTest Labs User directly on the approved lab to developer or tester groups. Configure restrictive lab policies first, keep secrets in Key Vault, and avoid resource-group or subscription scope unless every inherited resource is intentionally included.

Related roles (2)

Common questions

When should I assign the DevTest Labs User Azure role?

Assign DevTest Labs User when you need to: Allow a developer or tester to create, claim, connect to, start, restart, stop, and customize the user's own lab VMs.; and Let a lab member create the member's own template-based environments while remaining subject to lab policies and quotas.. Practical scope: Assign on the individual DevTest Labs lab. Resource-group or subscription assignments are inherited more broadly and can make the role's VM, network, deployment, and storage-key Actions effective against additional resources in scope.

What permissions does the DevTest Labs User Azure role grant?

The role definition grants 32 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Compute/availabilitySets/read; Microsoft.Compute/virtualMachines/*/read; Microsoft.Compute/virtualMachines/deallocate/action; Microsoft.Compute/virtualMachines/read; and Microsoft.Compute/virtualMachines/restart/action. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the DevTest Labs User Azure role?

Key considerations when assigning DevTest Labs User: Users become Owner of VMs they create or claim, giving them control over those VM resources beyond basic start and stop operations.; The published definition includes Microsoft.Storage/storageAccounts/listKeys/action. If the assignment scope includes a storage account, that operation returns its access keys; Microsoft documents that a shared key grants full access to the storage account data and the ability to generate SAS tokens.; The definition also includes network join Actions, so a parent-scope assignment can make storage-key and network operations effective outside one lab.; and The role cannot change lab policies or other users' VMs unless separate access is granted.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (9)

Official Microsoft Learn documentation →