Azure DevOps built-in role
Load Test Contributor
Reads the Azure Load Testing resource and carries supporting deployment and alert-rule control-plane Actions, while its DataActions create, update, delete, run, and stop load tests, test profiles, and profile runs. Playwright workspace operations are excluded, and the role does not change the top-level load-testing resource.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 749a398d-560b-491b-bb21-08924219302e
Control-plane actions (5)
Microsoft.LoadTestService/*/readMicrosoft.Authorization/*/readMicrosoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.Insights/alertRules/*
Data-plane actions (3)
Microsoft.LoadTestService/loadtests/*Microsoft.LoadTestService/testProfiles/*Microsoft.LoadTestService/testProfileRuns/*
Excluded actions (2)
Microsoft.LoadTestService/PlaywrightWorkspaces/*Microsoft.LoadTestService/locations/PlaywrightQuotas/*
Assignable scopes (1)
/
Practical scope
Assign directly on the Azure Load Testing resource. Resource-group or subscription assignments are inherited by every load-testing resource below them and also make the role's supporting deployment and alert-rule Actions effective more broadly.
Common use cases (2)
- Let a performance engineer or CI identity create, configure, execute, stop, and delete load tests and test profiles in one load-testing resource.
- Separate test authoring and execution from lifecycle management of the top-level Azure Load Testing resource.
Prerequisites (2)
- An Azure Load Testing resource must already exist before the principal can manage or run tests in it.
- Configure a load-testing managed identity and separate target permissions before tests reference Key Vault secrets, certificates, server metrics, or managed-identity-protected endpoints.
Best practices (3)
- Assign on the individual load-testing resource and use Load Test Reader for users who only inspect tests and results.
- Store secrets and client certificates in Azure Key Vault and use the load-testing resource managed identity instead of embedding values in test scripts.
- Review every permission granted to the load-testing managed identity because test runners can exercise that identity during execution.
Security considerations (3)
- The DataActions let the principal create, update, delete, start, and stop load tests, test profiles, and profile runs; this is test-management and execution authority rather than observation-only access.
- Microsoft warns that users authorized to run tests can use the load-testing resource managed identity to reach target resources such as Key Vault within that identity's permissions.
- Secrets and certificates retrieved for a test remain separate from Azure RBAC on the load-testing resource and must be protected in Key Vault.
Assignment guidance
Assign Load Test Contributor to the performance team or CI identity directly on one load-testing resource. Configure the resource managed identity and its Key Vault, metrics, or target permissions separately, and use Reader when test changes or execution are unnecessary.
Related roles (2)
- Load Test Reader: Provides read-only test, profile, run, and resource visibility without test execution or changes.
- Load Test Owner: Adds full control-plane management of the Azure Load Testing resource and broader service DataActions.
Common questions
When should I assign the Load Test Contributor Azure role?
Assign Load Test Contributor when you need to: Let a performance engineer or CI identity create, configure, execute, stop, and delete load tests and test profiles in one load-testing resource.; and Separate test authoring and execution from lifecycle management of the top-level Azure Load Testing resource.. Practical scope: Assign directly on the Azure Load Testing resource. Resource-group or subscription assignments are inherited by every load-testing resource below them and also make the role's supporting deployment and alert-rule Actions effective more broadly.
What permissions does the Load Test Contributor Azure role grant?
The role definition grants 8 combined control-plane and data-plane actions. Representative operations include: Microsoft.LoadTestService/*/read; Microsoft.Authorization/*/read; Microsoft.Resources/deployments/*; Microsoft.Resources/subscriptions/resourceGroups/read; Microsoft.Insights/alertRules/*; and Microsoft.LoadTestService/loadtests/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Load Test Contributor Azure role?
Key considerations when assigning Load Test Contributor: The DataActions let the principal create, update, delete, start, and stop load tests, test profiles, and profile runs; this is test-management and execution authority rather than observation-only access.; Microsoft warns that users authorized to run tests can use the load-testing resource managed identity to reach target resources such as Key Vault within that identity's permissions.; and Secrets and certificates retrieved for a test remain separate from Azure RBAC on the load-testing resource and must be protected in Key Vault.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (8)
- Azure built-in roles for DevOps - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-17.
- Manage roles in Azure Load Testing - Azure Load Testing | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Use managed identities for Azure Load Testing - Azure Load Testing | Microsoft Learn →
Supports: Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.
- Use secrets & environment variables - Azure Load Testing | Microsoft Learn →
Supports: Prerequisites, Best practices, Security considerations. Retrieved 2026-07-17.