Azure DevOps built-in role

Load Test Reader

Views Azure Load Testing resources, tests, test profiles, and their runs without changing or executing those service assets. The role combines service-read and alert-rule control-plane Actions with read-only test DataActions; Playwright workspaces are excluded.

Control-plane actions (4)

• Microsoft.LoadTestService/*/read
• Microsoft.Authorization/*/read
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Insights/alertRules/*

Data-plane actions (3)

• Microsoft.LoadTestService/loadtests/readTest/action
• Microsoft.LoadTestService/testProfiles/read
• Microsoft.LoadTestService/testProfileRuns/read

Excluded actions (2)

• Microsoft.LoadTestService/PlaywrightWorkspaces/*
• Microsoft.LoadTestService/locations/PlaywrightQuotas/*

Assignable scopes (1)

• /

Practical scope

Assign directly on the Azure Load Testing resource. A resource-group or subscription assignment is inherited by every load-testing resource below it and also broadens the supporting authorization, alert-rule, and resource-group visibility in the definition.

Common use cases (2)

• Let an application owner or auditor inspect test definitions, test profiles, execution history, and results without running or changing tests.
• Give a release reviewer read-only visibility into one team's Azure Load Testing resource.

Prerequisites (2)

• The Azure Load Testing resource and tests or profiles to review must already exist.
• The reviewer must be approved to see the test configuration and results for the target application.

Best practices (3)

• Assign Reader directly on the load-testing resource rather than a parent scope when only one team's tests are relevant.
• Use Contributor only when the principal must create, edit, delete, or execute tests or profiles.
• Keep Key Vault secret access and load-testing managed-identity permissions separate because Reader does not need them to inspect service records.

Security considerations (3)

• The read DataActions expose test definitions, profiles, run history, and results within the assigned resource.
• The role cannot run tests or use the load-testing resource managed identity during execution.
• The published definition includes alert-rule management Actions despite the product role being described as read-only for Load Testing assets, so direct resource scope is important.

Assignment guidance

Assign Load Test Reader directly on the load-testing resource to observers and reviewers. Do not add managed-identity target permissions for a reader-only workflow, and elevate to Contributor only for approved test authoring or execution.

Related roles (2)

• Load Test Contributor: Adds test and profile create, update, delete, and execution DataActions.
• Load Test Owner: Adds full lifecycle control of the load-testing resource and all service operations.

Editorial sources (8)

• Azure built-in roles for DevOps - Azure RBAC | Microsoft Learn →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-17.

• Manage roles in Azure Load Testing - Azure Load Testing | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Use managed identities for Azure Load Testing - Azure Load Testing | Microsoft Learn →

  Supports: Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Use secrets & environment variables - Azure Load Testing | Microsoft Learn →

  Supports: Prerequisites, Best practices, Security considerations. Retrieved 2026-07-17.

Official Microsoft Learn documentation →