Azure Identity built-in role

Managed Identity Contributor

Creates, reads, updates, and deletes user-assigned managed identities. The built-in role also manages their federated identity credentials and can revoke their tokens; it does not attach an identity to a workload or grant that identity access to another resource.

Control-plane actions (12)

• Microsoft.ManagedIdentity/userAssignedIdentities/read
• Microsoft.ManagedIdentity/userAssignedIdentities/write
• Microsoft.ManagedIdentity/userAssignedIdentities/delete
• Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read
• Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write
• Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/delete
• Microsoft.ManagedIdentity/userAssignedIdentities/revokeTokens/action
• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Resources/deployments/*
• Microsoft.Support/*

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The built-in definition is available throughout the Azure hierarchy. Effective access is limited to the selected assignment scope and inherited child scopes, normally the resource group containing the user-assigned identities. Its permissions are control-plane Actions and it has no DataActions.

Common use cases (2)

• Provision, tag, update, or delete user-assigned managed identities in an approved resource group.
• Manage federated identity credentials or revoke tokens for user-assigned managed identities.

Prerequisites (2)

• Select the subscription, resource group, region, and name for each user-assigned managed identity.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target scope.

Best practices (3)

• Separate identity lifecycle administration from workload attachment by assigning Managed Identity Operator to principals that only need to attach existing identities.
• Keep the role scoped to the resource group or specific identity set the lifecycle administrator owns.
• Grant each managed identity only the downstream resource permissions its workload requires, at the narrowest practical scope.

Security considerations (4)

• The role can delete user-assigned identities, change federated identity credentials, and revoke existing tokens.
• Deleting a user-assigned identity does not remove its reference from resources to which it was assigned, so deletion requires dependency review.
• A federated identity credential establishes trust with an external identity provider and must be treated as a credential-boundary change.
• The role has no DataActions and does not itself grant access to the downstream services a managed identity will call.

Assignment guidance

Assign Managed Identity Contributor to the team that owns user-assigned identity lifecycle and federated credentials, not to every workload deployer. Scope it to the identity resource group or a narrower boundary. Use Managed Identity Operator for attachment-only workflows and a separate Azure RBAC role assignment to grant the managed identity its runtime resource access.

Related roles (2)

• Managed Identity Operator: Reads and attaches existing user-assigned identities without lifecycle or federated-credential management.
• Role Based Access Control Administrator: Separate access-administration role used when the managed identity must receive Azure RBAC permissions on downstream resources.

Editorial sources (5)

• Azure built-in roles for Identity →

  Supports: Description, Practical scope, Common use cases, Security considerations, Related roles. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites, Related roles. Retrieved 2026-07-16.

• Manage user-assigned managed identities using the Azure portal →

  Supports: Description, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Managed identity best practice recommendations →

  Supports: Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

Official Microsoft Learn documentation →