Azure Databases built-in role
Azure Managed Redis Contributor
Creates and manages Azure Managed Redis resources through the Azure control plane. It has broad Microsoft.Cache/redisEnterprise management Actions but no DataActions, so it does not authorize Redis commands or access to keys and values stored in the cache.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 3015e5ed-6856-4ab3-b2f0-b8492aa30ca6
Control-plane actions (9)
Microsoft.Authorization/*/readMicrosoft.Cache/locations/operationsStatus/readMicrosoft.Cache/locations/checknameavailability/actionMicrosoft.Cache/operations/readMicrosoft.Cache/redisEnterprise/*Microsoft.Insights/alertRules/*Microsoft.ResourceHealth/availabilityStatuses/readMicrosoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on an individual Azure Managed Redis resource or its dedicated resource group when the operator owns the complete cache lifecycle. A parent assignment is inherited by every cache below it. Cache data access is configured separately through Microsoft Entra users or service principals and Redis access permissions.
Common use cases (2)
- Provision and configure an Azure Managed Redis cache by using the portal, Azure CLI, PowerShell, or infrastructure as code.
- Operate cache infrastructure settings, deployments, health, and monitoring without granting the operator Redis data access.
Prerequisites (2)
- Register or make available the Microsoft.Cache resource provider and identify the cache, SKU, region, network, availability, and persistence requirements.
- Configure Redis client identities separately when an application or operator also needs to execute commands against cached data.
Best practices (3)
- Use Azure Managed Redis Reader for view-only support and reserve this broad contributor role for cache lifecycle operators.
- Use Microsoft Entra authentication for clients, disable access-key authentication after migration, and assign only the Redis command and key permissions each client needs.
- Use private connectivity and avoid storing sensitive information without application-level protection because cache data in memory is not encrypted by the service.
Security considerations (3)
- The role can create, reconfigure, scale, and delete cache infrastructure, which can affect availability, performance, networking, and cost.
- No DataActions are present, but a cache administrator can change authentication and network configuration; direct Redis command and key access remains a separate authorization path.
- This is a broad contributor role and should not be described as least privilege for a narrower read, data-access, or monitoring task.
Assignment guidance
Assign Azure Managed Redis Contributor to the cache platform identity at the individual cache or dedicated resource-group scope. Grant Redis data access separately to application identities, and use Azure Managed Redis Reader when infrastructure changes are not required.
Related roles (1)
- Azure Managed Redis Reader: Read-only management-plane alternative that cannot modify the cache, retrieve access keys, or read cached data.
Common questions
When should I assign the Azure Managed Redis Contributor Azure role?
Assign Azure Managed Redis Contributor when you need to: Provision and configure an Azure Managed Redis cache by using the portal, Azure CLI, PowerShell, or infrastructure as code.; and Operate cache infrastructure settings, deployments, health, and monitoring without granting the operator Redis data access.. Practical scope: Assign on an individual Azure Managed Redis resource or its dedicated resource group when the operator owns the complete cache lifecycle. A parent assignment is inherited by every cache below it. Cache data access is configured separately through Microsoft Entra users or service principals and Redis access permissions.
What permissions does the Azure Managed Redis Contributor Azure role grant?
The role definition grants 9 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Cache/locations/operationsStatus/read; Microsoft.Cache/locations/checknameavailability/action; Microsoft.Cache/operations/read; Microsoft.Cache/redisEnterprise/*; and Microsoft.Insights/alertRules/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Managed Redis Contributor Azure role?
Key considerations when assigning Azure Managed Redis Contributor: The role can create, reconfigure, scale, and delete cache infrastructure, which can affect availability, performance, networking, and cost.; No DataActions are present, but a cache administrator can change authentication and network configuration; direct Redis command and key access remains a separate authorization path.; and This is a broad contributor role and should not be described as least privilege for a narrower read, data-access, or monitoring task.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Databases →
Supports: Description, Practical scope, Security considerations, Related roles. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-16.
- Manage an Azure Managed Redis cache using the Azure CLI →
Supports: Description, Practical scope, Common use cases, Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Use Microsoft Entra ID for cache authentication with Azure Managed Redis →
Supports: Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.
- Secure your Azure Managed Redis deployment →
Supports: Best practices, Security considerations. Retrieved 2026-07-16.