Azure DevOps built-in role

Lab Assistant

Views an existing Azure Lab Services lab, sends lab-registration invitations to users already listed in the lab, and can start, stop, reimage, or redeploy its lab virtual machines. The role has control-plane Actions only and no DataActions. Azure Lab Services retires on June 28, 2027, so this is transition and cleanup access rather than a new long-term assignment.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: ce40b423-cede-4313-a93f-9b28290b72e1

Control-plane actions (17)

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

Existing assignments are documented at an individual lab or at a resource group for every contained lab. Labs and lab plans are sibling resources, so a role on a lab plan is not inherited by its associated labs; a resource-group assignment is inherited by both.

Common use cases (2)

Prerequisites (2)

Best practices (3)

Security considerations (5)

Assignment guidance

Do not establish a new permanent assignment. If an existing lab still needs operational support during migration, retain or narrowly scope Lab Assistant on that lab, record its removal date, and remove the assignment at its originating scope after cutover.

Related roles (2)

Common questions

When should I assign the Lab Assistant Azure role?

Assign Lab Assistant when you need to: Keep an existing teaching assistant able to operate lab VMs while courses are moved to a replacement service before June 28, 2027.; and Inventory and remove Lab Assistant assignments as labs are decommissioned during the retirement plan.. Practical scope: Existing assignments are documented at an individual lab or at a resource group for every contained lab. Labs and lab plans are sibling resources, so a role on a lab plan is not inherited by its associated labs; a resource-group assignment is inherited by both.

What permissions does the Lab Assistant Azure role grant?

The role definition grants 17 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; Microsoft.LabServices/labPlans/images/read; Microsoft.LabServices/labPlans/read; Microsoft.LabServices/labs/read; and Microsoft.LabServices/labs/schedules/read. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Lab Assistant Azure role?

Key considerations when assigning Lab Assistant: Reimage deletes and recreates the lab VM from the original template; Microsoft documents that all data on the OS disk and temporary disk is lost.; Redeploy moves the lab VM to a different compute node. OS-disk data remains available, while temporary-disk data is lost.; The role can send registration invitations to users already listed in the lab as well as operate lab VMs, so invitation sends and destructive recovery actions both require review.; and A resource-group assignment permits VM operations across every inherited lab, while a lab-plan assignment does not flow to sibling labs.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (10)

Official Microsoft Learn documentation →