Azure Databases built-in role

Azure Managed Redis Contributor

Creates and manages Azure Managed Redis resources through the Azure control plane. It has broad Microsoft.Cache/redisEnterprise management Actions but no DataActions, so it does not authorize Redis commands or access to keys and values stored in the cache.

Control-plane actions (9)

• Microsoft.Authorization/*/read
• Microsoft.Cache/locations/operationsStatus/read
• Microsoft.Cache/locations/checknameavailability/action
• Microsoft.Cache/operations/read
• Microsoft.Cache/redisEnterprise/*
• Microsoft.Insights/alertRules/*
• Microsoft.ResourceHealth/availabilityStatuses/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on an individual Azure Managed Redis resource or its dedicated resource group when the operator owns the complete cache lifecycle. A parent assignment is inherited by every cache below it. Cache data access is configured separately through Microsoft Entra users or service principals and Redis access permissions.

Common use cases (2)

• Provision and configure an Azure Managed Redis cache by using the portal, Azure CLI, PowerShell, or infrastructure as code.
• Operate cache infrastructure settings, deployments, health, and monitoring without granting the operator Redis data access.

Prerequisites (2)

• Register or make available the Microsoft.Cache resource provider and identify the cache, SKU, region, network, availability, and persistence requirements.
• Configure Redis client identities separately when an application or operator also needs to execute commands against cached data.

Best practices (3)

• Use Azure Managed Redis Reader for view-only support and reserve this broad contributor role for cache lifecycle operators.
• Use Microsoft Entra authentication for clients, disable access-key authentication after migration, and assign only the Redis command and key permissions each client needs.
• Use private connectivity and avoid storing sensitive information without application-level protection because cache data in memory is not encrypted by the service.

Security considerations (3)

• The role can create, reconfigure, scale, and delete cache infrastructure, which can affect availability, performance, networking, and cost.
• No DataActions are present, but a cache administrator can change authentication and network configuration; direct Redis command and key access remains a separate authorization path.
• This is a broad contributor role and should not be described as least privilege for a narrower read, data-access, or monitoring task.

Assignment guidance

Assign Azure Managed Redis Contributor to the cache platform identity at the individual cache or dedicated resource-group scope. Grant Redis data access separately to application identities, and use Azure Managed Redis Reader when infrastructure changes are not required.

Related roles (1)

• Azure Managed Redis Reader: Read-only management-plane alternative that cannot modify the cache, retrieve access keys, or read cached data.

Editorial sources (7)

• Azure built-in roles for Databases →

  Supports: Description, Practical scope, Security considerations, Related roles. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Manage an Azure Managed Redis cache using the Azure CLI →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Use Microsoft Entra ID for cache authentication with Azure Managed Redis →

  Supports: Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• Secure your Azure Managed Redis deployment →

  Supports: Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →