Azure DevOps built-in role

Load Test Owner

Performs all published Azure Load Testing resource and test operations except Playwright workspace operations. It combines a broad control-plane Microsoft.LoadTestService wildcard with a broad service DataAction wildcard; the published definition does not include Microsoft.Authorization/roleAssignments/write.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: 45bb0b16-2f0c-4e78-afaa-a07599b003f6

Control-plane actions (5)

Data-plane actions (1)

Excluded actions (2)

Assignable scopes (1)

Practical scope

Assign directly on the Azure Load Testing resource unless the same trusted platform identity owns every inherited load-testing resource. A resource-group or subscription assignment broadens resource lifecycle, test execution, deployment, and alert-rule authority.

Common use cases (2)

Prerequisites (2)

Best practices (3)

Security considerations (3)

Assignment guidance

Reserve Load Test Owner for the platform identity that manages the lifecycle of one load-testing resource. Assign Contributor to test authors, Reader to observers, and a separate access-administration role to principals that create Azure role assignments.

Related roles (2)

Common questions

When should I assign the Load Test Owner Azure role?

Assign Load Test Owner when you need to: Give a trusted load-testing platform owner full lifecycle control of one Azure Load Testing resource and all tests, profiles, runs, and artifacts within it.; and Modify or delete the top-level load-testing resource in addition to authoring and executing tests.. Practical scope: Assign directly on the Azure Load Testing resource unless the same trusted platform identity owns every inherited load-testing resource. A resource-group or subscription assignment broadens resource lifecycle, test execution, deployment, and alert-rule authority.

What permissions does the Load Test Owner Azure role grant?

The role definition grants 6 combined control-plane and data-plane actions. Representative operations include: Microsoft.LoadTestService/*; Microsoft.Authorization/*/read; Microsoft.Resources/deployments/*; Microsoft.Resources/subscriptions/resourceGroups/read; Microsoft.Insights/alertRules/*; and Microsoft.LoadTestService/*. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Load Test Owner Azure role?

Key considerations when assigning Load Test Owner: The role can delete or reconfigure the load-testing resource and can execute all service DataActions, making it broader than Contributor and unsuitable as a least-privilege default.; A test runner can exercise the load-testing resource managed identity against resources that identity can access, including Key Vault and monitored targets.; and Although the product access guide describes Owner as full access, the published role definition has authorization reads but no role-assignment write Action; access delegation must be verified separately.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (8)

Official Microsoft Learn documentation →