Azure DevOps built-in role

Lab Creator

Creates Azure Lab Services labs and gives the creator full control over labs the creator makes. The definition contains legacy lab-account control-plane Actions and the current lab-plan create-lab DataAction. Azure Lab Services retires on June 28, 2027, so the role should support only an approved interim migration path.

Control-plane actions (18)

• Microsoft.Authorization/*/read
• Microsoft.LabServices/labAccounts/*/read
• Microsoft.LabServices/labAccounts/createLab/action
• Microsoft.LabServices/labAccounts/getPricingAndAvailability/action
• Microsoft.LabServices/labAccounts/getRestrictionsAndUsage/action
• Microsoft.Insights/alertRules/*
• Microsoft.LabServices/labPlans/images/read
• Microsoft.LabServices/labPlans/read
• Microsoft.LabServices/labPlans/saveImage/action
• Microsoft.LabServices/labs/read
• Microsoft.LabServices/labs/schedules/read
• Microsoft.LabServices/labs/users/read
• Microsoft.LabServices/labs/virtualMachines/read
• Microsoft.LabServices/locations/usages/read
• Microsoft.LabServices/skus/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Support/*

Data-plane actions (1)

• Microsoft.LabServices/labPlans/createLab/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Existing guidance supports assignment on one lab plan or on a resource group containing lab plans. Lab plans and labs are sibling resources, so a role on a lab plan is not inherited by a created lab; the service separately grants the creator control of that lab. Resource-group assignments are inherited by both plans and labs.

Common use cases (2)

• Maintain an existing educator's ability to create a final interim lab while courses transition to a replacement platform before retirement.
• Inventory Lab Creator assignments and map each creator and lab plan to the retirement and resource-cleanup plan.

Prerequisites (2)

• A documented exception must justify any remaining lab creation before June 28, 2027 and identify the replacement service and cutover date.
• The current lab plan, capacity, images, networking, and course requirements must already be approved for the transition period.

Best practices (3)

• Do not grant Lab Creator for a new long-lived deployment; use the retirement window to move to a recommended Microsoft or partner solution.
• If an interim lab is unavoidable, use one lab-plan scope instead of a resource group containing multiple plans and labs.
• Migrate legacy lab-account workflows to lab plans only as an interim step, then delete idle resources and remove role assignments.

Security considerations (3)

• A creator receives control over each lab the creator makes, including lab settings, deletion, and role assignment on that created lab.
• A resource-group assignment exposes other labs in the group, whereas a lab-plan assignment does not grant visibility into labs created by other users because plans and labs are siblings.
• Continuing to create labs increases the migration and cleanup surface before the fixed retirement date.

Assignment guidance

Do not create a new permanent Lab Creator grant. Where an approved interim lab is unavoidable, retain or assign it on the one existing lab plan, record the migration and removal dates, and remove the assignment after the replacement workflow and lab cleanup are complete.

Related roles (2)

• Lab Contributor: Co-manages one existing lab but does not create new labs.
• Lab Services Contributor: Broader administrator role for Lab Services resources in a resource group during transition and cleanup.

Editorial sources (8)

• Azure built-in roles for DevOps - Azure RBAC | Microsoft Learn →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-17.

• Remove Azure role assignments →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Azure role-based access control - Azure Lab Services | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Azure Lab Services retirement guide - Azure Lab Services | Microsoft Learn →

  Supports: Description, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Migrate lab account role assignments to lab plans in Azure Lab Services →

  Supports: Practical scope, Best practices. Retrieved 2026-07-17.

Official Microsoft Learn documentation →