Azure Monitor built-in role

Log Analytics Contributor

Reads monitoring data and administers Log Analytics and related monitoring settings. The published definition combines broad control-plane Actions with a Log Analytics data-export DataAction, so it is broader than a workspace configuration role and broader than a query-only data reader.

Control-plane actions (13)

• */read
• Microsoft.ClassicCompute/virtualMachines/extensions/*
• Microsoft.ClassicStorage/storageAccounts/listKeys/action
• Microsoft.Compute/virtualMachines/extensions/*
• Microsoft.HybridCompute/machines/extensions/write
• Microsoft.Insights/alertRules/*
• Microsoft.Insights/diagnosticSettings/*
• Microsoft.OperationalInsights/*
• Microsoft.OperationsManagement/*
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourcegroups/deployments/*
• Microsoft.Storage/storageAccounts/listKeys/action
• Microsoft.Support/*

Data-plane actions (1)

• Microsoft.OperationalInsights/workspaces/jobs/export/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on a workspace for workspace-specific administration. Some documented operations, including Automation accounts, management solutions, resource diagnostics, and VM extensions, require resource-group or subscription scope and therefore reach resources outside the workspace.

Common use cases (2)

• Configure a Log Analytics workspace, its saved searches, data export, search jobs, restored logs, and monitoring solutions.
• Configure diagnostic collection or monitoring extensions on approved Azure resources when the full documented role boundary is required.

Prerequisites (2)

• Identify the workspace access control mode and every resource, storage account, event hub, or virtual machine involved in the monitoring workflow.
• Use a resource-group or subscription assignment only when the workflow requires the operations that Microsoft documents at those broader scopes.

Best practices (3)

• Use Log Analytics Data Reader or Log Analytics Reader when the principal only needs to query or inspect data and settings.
• Assign at the workspace when resource-level diagnostics, VM extensions, Automation accounts, or management solutions are not part of the task.
• Keep monitoring storage accounts and event hubs in dedicated scopes and avoid granting their key permissions at subscription scope.

Security considerations (3)

• Microsoft warns that permission to add a virtual machine extension can be used to gain full control over a virtual machine.
• The role can read storage account keys, configure data collection, restore retained data, and export workspace data.
• Its data-export DataAction moves log data beyond query access, while its broad Actions can change monitoring configuration across the assigned scope.

Assignment guidance

Assign Log Analytics Contributor at the workspace for workspace administration. Use a broader scope only for a reviewed workflow that needs resource diagnostics, VM extensions, Automation, or solutions, and choose Reader or Data Reader for query-only access.

Related roles (2)

• Log Analytics Reader: Read-oriented role for broad monitoring data and settings without Log Analytics configuration writes.
• Log Analytics Data Reader: Minimum query and table-data role Microsoft recommends for granular table- and row-level data access.

Editorial sources (7)

• Azure built-in roles for Monitor →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Manage access to Log Analytics workspaces →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Roles, permissions, and security in Azure Monitor →

  Supports: Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• Granular RBAC in Azure Monitor →

  Supports: Best practices, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →