Azure DevOps built-in role
Load Test Reader
Views Azure Load Testing resources, tests, test profiles, and their runs without changing or executing those service assets. The role combines service-read and alert-rule control-plane Actions with read-only test DataActions; Playwright workspaces are excluded.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 3ae3fb29-0000-4ccd-bf80-542e7b26e081
Control-plane actions (4)
Microsoft.LoadTestService/*/readMicrosoft.Authorization/*/readMicrosoft.Resources/subscriptions/resourceGroups/readMicrosoft.Insights/alertRules/*
Data-plane actions (3)
Microsoft.LoadTestService/loadtests/readTest/actionMicrosoft.LoadTestService/testProfiles/readMicrosoft.LoadTestService/testProfileRuns/read
Excluded actions (2)
Microsoft.LoadTestService/PlaywrightWorkspaces/*Microsoft.LoadTestService/locations/PlaywrightQuotas/*
Assignable scopes (1)
/
Practical scope
Assign directly on the Azure Load Testing resource. A resource-group or subscription assignment is inherited by every load-testing resource below it and also broadens the supporting authorization, alert-rule, and resource-group visibility in the definition.
Common use cases (2)
- Let an application owner or auditor inspect test definitions, test profiles, execution history, and results without running or changing tests.
- Give a release reviewer read-only visibility into one team's Azure Load Testing resource.
Prerequisites (2)
- The Azure Load Testing resource and tests or profiles to review must already exist.
- The reviewer must be approved to see the test configuration and results for the target application.
Best practices (3)
- Assign Reader directly on the load-testing resource rather than a parent scope when only one team's tests are relevant.
- Use Contributor only when the principal must create, edit, delete, or execute tests or profiles.
- Keep Key Vault secret access and load-testing managed-identity permissions separate because Reader does not need them to inspect service records.
Security considerations (3)
- The read DataActions expose test definitions, profiles, run history, and results within the assigned resource.
- The role cannot run tests or use the load-testing resource managed identity during execution.
- The published definition includes alert-rule management Actions despite the product role being described as read-only for Load Testing assets, so direct resource scope is important.
Assignment guidance
Assign Load Test Reader directly on the load-testing resource to observers and reviewers. Do not add managed-identity target permissions for a reader-only workflow, and elevate to Contributor only for approved test authoring or execution.
Related roles (2)
- Load Test Contributor: Adds test and profile create, update, delete, and execution DataActions.
- Load Test Owner: Adds full lifecycle control of the load-testing resource and all service operations.
Common questions
When should I assign the Load Test Reader Azure role?
Assign Load Test Reader when you need to: Let an application owner or auditor inspect test definitions, test profiles, execution history, and results without running or changing tests.; and Give a release reviewer read-only visibility into one team's Azure Load Testing resource.. Practical scope: Assign directly on the Azure Load Testing resource. A resource-group or subscription assignment is inherited by every load-testing resource below it and also broadens the supporting authorization, alert-rule, and resource-group visibility in the definition.
What permissions does the Load Test Reader Azure role grant?
The role definition grants 7 combined control-plane and data-plane actions. Representative operations include: Microsoft.LoadTestService/*/read; Microsoft.Authorization/*/read; Microsoft.Resources/subscriptions/resourceGroups/read; Microsoft.Insights/alertRules/*; Microsoft.LoadTestService/loadtests/readTest/action; and Microsoft.LoadTestService/testProfiles/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Load Test Reader Azure role?
Key considerations when assigning Load Test Reader: The read DataActions expose test definitions, profiles, run history, and results within the assigned resource.; The role cannot run tests or use the load-testing resource managed identity during execution.; and The published definition includes alert-rule management Actions despite the product role being described as read-only for Load Testing assets, so direct resource scope is important.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (8)
- Azure built-in roles for DevOps - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-17.
- Manage roles in Azure Load Testing - Azure Load Testing | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Use managed identities for Azure Load Testing - Azure Load Testing | Microsoft Learn →
Supports: Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.
- Use secrets & environment variables - Azure Load Testing | Microsoft Learn →
Supports: Prerequisites, Best practices, Security considerations. Retrieved 2026-07-17.