Azure DevOps built-in role

Load Test Owner

Performs all published Azure Load Testing resource and test operations except Playwright workspace operations. It combines a broad control-plane Microsoft.LoadTestService wildcard with a broad service DataAction wildcard; the published definition does not include Microsoft.Authorization/roleAssignments/write.

Control-plane actions (5)

• Microsoft.LoadTestService/*
• Microsoft.Authorization/*/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Insights/alertRules/*

Data-plane actions (1)

• Microsoft.LoadTestService/*

Excluded actions (2)

• Microsoft.LoadTestService/PlaywrightWorkspaces/*
• Microsoft.LoadTestService/locations/PlaywrightQuotas/*

Assignable scopes (1)

• /

Practical scope

Assign directly on the Azure Load Testing resource unless the same trusted platform identity owns every inherited load-testing resource. A resource-group or subscription assignment broadens resource lifecycle, test execution, deployment, and alert-rule authority.

Common use cases (2)

• Give a trusted load-testing platform owner full lifecycle control of one Azure Load Testing resource and all tests, profiles, runs, and artifacts within it.
• Modify or delete the top-level load-testing resource in addition to authoring and executing tests.

Prerequisites (2)

• Confirm the principal genuinely needs top-level resource lifecycle authority rather than the test-focused Contributor role.
• Configure and separately authorize the load-testing resource managed identity for any Key Vault, metrics, or target-resource access used during tests.

Best practices (3)

• Use Load Test Contributor for test authors and runners who do not manage or delete the top-level resource.
• Keep role-assignment administration on a separate role that explicitly includes Microsoft.Authorization/roleAssignments/write.
• Use managed identities and Key Vault references for secrets and certificates and review the managed identity permissions before each new test workflow.

Security considerations (3)

• The role can delete or reconfigure the load-testing resource and can execute all service DataActions, making it broader than Contributor and unsuitable as a least-privilege default.
• A test runner can exercise the load-testing resource managed identity against resources that identity can access, including Key Vault and monitored targets.
• Although the product access guide describes Owner as full access, the published role definition has authorization reads but no role-assignment write Action; access delegation must be verified separately.

Assignment guidance

Reserve Load Test Owner for the platform identity that manages the lifecycle of one load-testing resource. Assign Contributor to test authors, Reader to observers, and a separate access-administration role to principals that create Azure role assignments.

Related roles (2)

• Load Test Contributor: Manages and executes tests and profiles without changing the top-level load-testing resource.
• Load Test Reader: Provides read-only visibility without resource or test changes.

Editorial sources (8)

• Azure built-in roles for DevOps - Azure RBAC | Microsoft Learn →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-17.

• Manage roles in Azure Load Testing - Azure Load Testing | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Use managed identities for Azure Load Testing - Azure Load Testing | Microsoft Learn →

  Supports: Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Use secrets & environment variables - Azure Load Testing | Microsoft Learn →

  Supports: Prerequisites, Best practices, Security considerations. Retrieved 2026-07-17.

Official Microsoft Learn documentation →