Azure DevOps built-in role

Load Test Contributor

Reads the Azure Load Testing resource and carries supporting deployment and alert-rule control-plane Actions, while its DataActions create, update, delete, run, and stop load tests, test profiles, and profile runs. Playwright workspace operations are excluded, and the role does not change the top-level load-testing resource.

Control-plane actions (5)

• Microsoft.LoadTestService/*/read
• Microsoft.Authorization/*/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Insights/alertRules/*

Data-plane actions (3)

• Microsoft.LoadTestService/loadtests/*
• Microsoft.LoadTestService/testProfiles/*
• Microsoft.LoadTestService/testProfileRuns/*

Excluded actions (2)

• Microsoft.LoadTestService/PlaywrightWorkspaces/*
• Microsoft.LoadTestService/locations/PlaywrightQuotas/*

Assignable scopes (1)

• /

Practical scope

Assign directly on the Azure Load Testing resource. Resource-group or subscription assignments are inherited by every load-testing resource below them and also make the role's supporting deployment and alert-rule Actions effective more broadly.

Common use cases (2)

• Let a performance engineer or CI identity create, configure, execute, stop, and delete load tests and test profiles in one load-testing resource.
• Separate test authoring and execution from lifecycle management of the top-level Azure Load Testing resource.

Prerequisites (2)

• An Azure Load Testing resource must already exist before the principal can manage or run tests in it.
• Configure a load-testing managed identity and separate target permissions before tests reference Key Vault secrets, certificates, server metrics, or managed-identity-protected endpoints.

Best practices (3)

• Assign on the individual load-testing resource and use Load Test Reader for users who only inspect tests and results.
• Store secrets and client certificates in Azure Key Vault and use the load-testing resource managed identity instead of embedding values in test scripts.
• Review every permission granted to the load-testing managed identity because test runners can exercise that identity during execution.

Security considerations (3)

• The DataActions let the principal create, update, delete, start, and stop load tests, test profiles, and profile runs; this is test-management and execution authority rather than observation-only access.
• Microsoft warns that users authorized to run tests can use the load-testing resource managed identity to reach target resources such as Key Vault within that identity's permissions.
• Secrets and certificates retrieved for a test remain separate from Azure RBAC on the load-testing resource and must be protected in Key Vault.

Assignment guidance

Assign Load Test Contributor to the performance team or CI identity directly on one load-testing resource. Configure the resource managed identity and its Key Vault, metrics, or target permissions separately, and use Reader when test changes or execution are unnecessary.

Related roles (2)

• Load Test Reader: Provides read-only test, profile, run, and resource visibility without test execution or changes.
• Load Test Owner: Adds full control-plane management of the Azure Load Testing resource and broader service DataActions.

Editorial sources (8)

• Azure built-in roles for DevOps - Azure RBAC | Microsoft Learn →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-17.

• Manage roles in Azure Load Testing - Azure Load Testing | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Use managed identities for Azure Load Testing - Azure Load Testing | Microsoft Learn →

  Supports: Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Use secrets & environment variables - Azure Load Testing | Microsoft Learn →

  Supports: Prerequisites, Best practices, Security considerations. Retrieved 2026-07-17.

Official Microsoft Learn documentation →