Azure Identity built-in role
Managed Identity Operator
Reads user-assigned managed identities and attaches existing identities to supported Azure resources. It does not create, update, or delete the identity and does not grant the identity permissions on downstream resources.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: f1a07417-d97a-45cb-824c-7a7467783830
Control-plane actions (7)
Microsoft.ManagedIdentity/userAssignedIdentities/*/readMicrosoft.ManagedIdentity/userAssignedIdentities/*/assign/actionMicrosoft.Authorization/*/readMicrosoft.Insights/alertRules/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.Resources/deployments/*Microsoft.Support/*
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
The built-in definition is available throughout the Azure hierarchy. Effective access is limited to the selected scope and inherited child scopes, ideally the specific identity or identity resource group. Its permissions are control-plane Actions and it has no DataActions.
Common use cases (2)
- Let a workload deployment principal select and attach an approved user-assigned managed identity.
- List and inspect user-assigned managed identities without granting identity lifecycle management.
Prerequisites (3)
- The user-assigned managed identity must already exist.
- The assignee also needs permission to update the target Azure resource; for a virtual machine, Microsoft documents Virtual Machine Contributor together with Managed Identity Operator.
- The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target identity scope.
Best practices (3)
- Scope this role to only the identities that a deployment principal is allowed to attach.
- Keep identity attachment separate from identity lifecycle management by reserving Managed Identity Contributor for identity owners.
- Before allowing attachment, review the permissions already granted to the managed identity and the code-execution rights on the target resource.
Security considerations (3)
- Code running on a resource can use every permission granted to an attached managed identity.
- A principal that can both attach a powerful identity and execute code on the target resource can exercise that identity's downstream access.
- The role has no DataActions itself, but attaching an identity can indirectly expose the data-plane permissions held by that identity.
Assignment guidance
Assign Managed Identity Operator to workload deployment principals that must attach approved existing identities, scoped to those identities. Grant target-resource write access separately, and verify the attached identity has only the downstream permissions the workload needs. Use Managed Identity Contributor only for lifecycle or federated-credential administration.
Related roles (2)
- Managed Identity Contributor: Adds creation, update, deletion, federated-credential management, and token revocation for user-assigned identities.
- Workload-specific Azure contributor role: Separate permission needed to update the target resource; Microsoft documents Virtual Machine Contributor for VM attachment.
Common questions
When should I assign the Managed Identity Operator Azure role?
Assign Managed Identity Operator when you need to: Let a workload deployment principal select and attach an approved user-assigned managed identity.; and List and inspect user-assigned managed identities without granting identity lifecycle management.. Practical scope: The built-in definition is available throughout the Azure hierarchy. Effective access is limited to the selected scope and inherited child scopes, ideally the specific identity or identity resource group. Its permissions are control-plane Actions and it has no DataActions.
What permissions does the Managed Identity Operator Azure role grant?
The role definition grants 7 combined control-plane and data-plane actions. Representative operations include: Microsoft.ManagedIdentity/userAssignedIdentities/*/read; Microsoft.ManagedIdentity/userAssignedIdentities/*/assign/action; Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; Microsoft.Resources/subscriptions/resourceGroups/read; and Microsoft.Resources/deployments/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Managed Identity Operator Azure role?
Key considerations when assigning Managed Identity Operator: Code running on a resource can use every permission granted to an attached managed identity.; A principal that can both attach a powerful identity and execute code on the target resource can exercise that identity's downstream access.; and The role has no DataActions itself, but attaching an identity can indirectly expose the data-plane permissions held by that identity.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Identity →
Supports: Description, Practical scope, Common use cases, Security considerations, Related roles. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites. Retrieved 2026-07-16.
- Manage user-assigned managed identities using the Azure portal →
Supports: Description, Common use cases, Best practices. Retrieved 2026-07-16.
- Managed identity best practice recommendations →
Supports: Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.
- Configure managed identities on Azure virtual machines →
Supports: Prerequisites, Assignment guidance, Related roles. Retrieved 2026-07-16.