Azure DevOps built-in role
Lab Services Contributor
Broadly manages Azure Lab Services resources without Azure role-assignment authority. It combines a Microsoft.LabServices control-plane wildcard with the lab-plan create-lab DataAction; Microsoft documents that it cannot change or delete other users' labs. Azure Lab Services retires on June 28, 2027.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: f69b8690-cc87-41d6-b77a-a4bc3c0a966f
Control-plane actions (5)
Microsoft.LabServices/*Microsoft.Insights/alertRules/*Microsoft.Authorization/*/readMicrosoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/read
Data-plane actions (1)
Microsoft.LabServices/labPlans/createLab/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
The documented administrator assignment is on a dedicated resource group, where it is inherited by lab plans and labs in that group. Lab plans and labs are siblings, so a lab-plan assignment alone is not inherited by associated labs.
Common use cases (2)
- Operate and inventory existing Lab Services resources across a dedicated resource group while they are migrated and decommissioned.
- Create an interim lab only when required by an approved retirement exception, without granting access to unrelated Azure resource providers.
Prerequisites (2)
- The resource group must contain only Lab Services resources that are part of the same migration and cleanup plan.
- A retirement owner must document the replacement solution, resource inventory, migration dependencies, cutover date, and access-removal date.
Best practices (3)
- Do not establish this broad role for a new long-term service; transition to a recommended Microsoft or partner solution before retirement.
- Keep the assignment on a dedicated Lab Services resource group and do not describe it as least privilege for one lab or view-only task.
- Delete idle labs and plans and remove the assignment as each migration wave completes.
Security considerations (3)
- The role can create, configure, publish, and delete broad Lab Services resources in scope and can operate lab virtual machines.
- Its create-lab DataAction spans the Lab Services user plane, while the control-plane wildcard manages service resources and deployment operations.
- A resource-group assignment is inherited by every lab plan and lab in the group, increasing both operational and cleanup impact.
Assignment guidance
Do not grant Lab Services Contributor as a new permanent access model. Retain it only for a trusted migration operator on a dedicated Lab Services resource group, document the fixed retirement milestones, and remove the assignment after all resources in that scope are migrated or deleted.
Related roles (2)
- Lab Creator: Narrower transition role for creating and controlling the assignee's own labs from one plan or resource group.
- Lab Contributor: Narrower role for managing one existing lab without creating new labs.
Common questions
When should I assign the Lab Services Contributor Azure role?
Assign Lab Services Contributor when you need to: Operate and inventory existing Lab Services resources across a dedicated resource group while they are migrated and decommissioned.; and Create an interim lab only when required by an approved retirement exception, without granting access to unrelated Azure resource providers.. Practical scope: The documented administrator assignment is on a dedicated resource group, where it is inherited by lab plans and labs in that group. Lab plans and labs are siblings, so a lab-plan assignment alone is not inherited by associated labs.
What permissions does the Lab Services Contributor Azure role grant?
The role definition grants 6 combined control-plane and data-plane actions. Representative operations include: Microsoft.LabServices/*; Microsoft.Insights/alertRules/*; Microsoft.Authorization/*/read; Microsoft.Resources/deployments/*; Microsoft.Resources/subscriptions/resourceGroups/read; and Microsoft.LabServices/labPlans/createLab/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Lab Services Contributor Azure role?
Key considerations when assigning Lab Services Contributor: The role can create, configure, publish, and delete broad Lab Services resources in scope and can operate lab virtual machines.; Its create-lab DataAction spans the Lab Services user plane, while the control-plane wildcard manages service resources and deployment operations.; and A resource-group assignment is inherited by every lab plan and lab in the group, increasing both operational and cleanup impact.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (8)
- Azure built-in roles for DevOps - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-17.
- Remove Azure role assignments →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Azure role-based access control - Azure Lab Services | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Azure Lab Services retirement guide - Azure Lab Services | Microsoft Learn →
Supports: Description, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.
- Migrate lab account role assignments to lab plans in Azure Lab Services →
Supports: Practical scope, Best practices. Retrieved 2026-07-17.