Azure DevOps built-in role

Lab Operator

The lab operator role

Control-plane and data-plane permissions below are imported directly from Microsoft Learn. In-app editorial guidance (use cases, best practices, security notes) and least-privilege recommendations are still pending review.

Role definition ID: a36e6959-b6be-4b12-8e9f-ef4b474d304d

Control-plane actions (24)

Microsoft.Authorization/*/read
Microsoft.Insights/alertRules/*
Microsoft.LabServices/labPlans/images/read
Microsoft.LabServices/labPlans/read
Microsoft.LabServices/labPlans/saveImage/action
Microsoft.LabServices/labs/publish/action
Microsoft.LabServices/labs/read
Microsoft.LabServices/labs/schedules/read
Microsoft.LabServices/labs/schedules/write
Microsoft.LabServices/labs/schedules/delete
Microsoft.LabServices/labs/users/read
Microsoft.LabServices/labs/users/write
Microsoft.LabServices/labs/users/delete
Microsoft.LabServices/labs/users/invite/action
Microsoft.LabServices/labs/virtualMachines/read
Microsoft.LabServices/labs/virtualMachines/start/action
Microsoft.LabServices/labs/virtualMachines/stop/action
Microsoft.LabServices/labs/virtualMachines/reimage/action
Microsoft.LabServices/labs/virtualMachines/redeploy/action
Microsoft.LabServices/labs/virtualMachines/resetPassword/action
Microsoft.LabServices/locations/usages/read
Microsoft.LabServices/skus/read
Microsoft.Resources/deployments/*
Microsoft.Resources/subscriptions/resourceGroups/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

Official Microsoft Learn documentation →