Azure Identity built-in role

Managed Identity Operator

Reads user-assigned managed identities and attaches existing identities to supported Azure resources. It does not create, update, or delete the identity and does not grant the identity permissions on downstream resources.

Control-plane actions (7)

• Microsoft.ManagedIdentity/userAssignedIdentities/*/read
• Microsoft.ManagedIdentity/userAssignedIdentities/*/assign/action
• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Resources/deployments/*
• Microsoft.Support/*

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The built-in definition is available throughout the Azure hierarchy. Effective access is limited to the selected scope and inherited child scopes, ideally the specific identity or identity resource group. Its permissions are control-plane Actions and it has no DataActions.

Common use cases (2)

• Let a workload deployment principal select and attach an approved user-assigned managed identity.
• List and inspect user-assigned managed identities without granting identity lifecycle management.

Prerequisites (3)

• The user-assigned managed identity must already exist.
• The assignee also needs permission to update the target Azure resource; for a virtual machine, Microsoft documents Virtual Machine Contributor together with Managed Identity Operator.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target identity scope.

Best practices (3)

• Scope this role to only the identities that a deployment principal is allowed to attach.
• Keep identity attachment separate from identity lifecycle management by reserving Managed Identity Contributor for identity owners.
• Before allowing attachment, review the permissions already granted to the managed identity and the code-execution rights on the target resource.

Security considerations (3)

• Code running on a resource can use every permission granted to an attached managed identity.
• A principal that can both attach a powerful identity and execute code on the target resource can exercise that identity's downstream access.
• The role has no DataActions itself, but attaching an identity can indirectly expose the data-plane permissions held by that identity.

Assignment guidance

Assign Managed Identity Operator to workload deployment principals that must attach approved existing identities, scoped to those identities. Grant target-resource write access separately, and verify the attached identity has only the downstream permissions the workload needs. Use Managed Identity Contributor only for lifecycle or federated-credential administration.

Related roles (2)

• Managed Identity Contributor: Adds creation, update, deletion, federated-credential management, and token revocation for user-assigned identities.
• Workload-specific Azure contributor role: Separate permission needed to update the target resource; Microsoft documents Virtual Machine Contributor for VM attachment.

Editorial sources (6)

• Azure built-in roles for Identity →

  Supports: Description, Practical scope, Common use cases, Security considerations, Related roles. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites. Retrieved 2026-07-16.

• Manage user-assigned managed identities using the Azure portal →

  Supports: Description, Common use cases, Best practices. Retrieved 2026-07-16.

• Managed identity best practice recommendations →

  Supports: Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• Configure managed identities on Azure virtual machines →

  Supports: Prerequisites, Assignment guidance, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →