Azure Networking built-in role
Network Contributor
Broadly manages all Azure Resource Manager network resource types exposed through Microsoft.Network/* at the assigned scope, but cannot deploy or manage virtual machines and cannot create Azure RBAC role assignments. This is a broad privileged network control-plane role, not a least-privilege default.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 4d97b98b-1d4f-4787-a291-c67834d212e7
Control-plane actions (7)
Microsoft.Authorization/*/readMicrosoft.Insights/alertRules/*Microsoft.Network/*Microsoft.ResourceHealth/availabilityStatuses/readMicrosoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.Support/*
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
The built-in definition is available throughout the Azure hierarchy. An assignment at management-group, subscription, or resource-group scope is inherited by every child Microsoft.Network resource. The role grants the Microsoft.Network/* control-plane wildcard plus deployment, classic alert, support, resource-health-read, authorization-read, and resource-group-read Actions. It has no DataActions.
Common use cases (2)
- Administer a complete set of Azure Resource Manager network resources in a tightly bounded networking resource group when narrower roles cannot cover the required operations.
- Run network deployment automation that genuinely requires the full Microsoft.Network/* control-plane surface without Azure RBAC delegation or virtual-machine management.
Prerequisites (2)
- Inventory the network resources and dependencies the principal must change and confirm that narrower built-in or custom roles are insufficient.
- Select the smallest scope that contains those network resources; the assigning administrator needs Microsoft.Authorization/roleAssignments/write at that scope.
Best practices (3)
- Do not use Network Contributor as the default networking role; start from the exact required Actions and choose a narrower job-function or custom role when possible.
- Keep broad assignments at a dedicated networking resource group or narrower scope and review inherited management-group or subscription assignments regularly.
- Use formal change control for routing, address-space, security-boundary, connectivity, and deletion operations, and monitor the wildcard definition as Microsoft.Network adds operations.
Security considerations (3)
- Microsoft.Network/* can create, change, or delete every current network resource type under that provider in scope, including resources that enforce connectivity and network security boundaries.
- A compromised principal can cause widespread outage, isolation, or unintended exposure across every inheriting child network resource.
- The absence of DataActions and virtual-machine permissions does not make this role low risk; its broad control-plane wildcard remains highly privileged.
Assignment guidance
Reserve Network Contributor for trusted network administrators or automation that demonstrably needs the full Microsoft.Network/* control plane. Never call it least privilege. Prefer a dedicated networking resource group or resource scope, document why narrower roles are insufficient, and review the assignment and wildcard exposure regularly.
Common questions
When should I assign the Network Contributor Azure role?
Assign Network Contributor when you need to: Administer a complete set of Azure Resource Manager network resources in a tightly bounded networking resource group when narrower roles cannot cover the required operations.; and Run network deployment automation that genuinely requires the full Microsoft.Network/* control-plane surface without Azure RBAC delegation or virtual-machine management.. Practical scope: The built-in definition is available throughout the Azure hierarchy. An assignment at management-group, subscription, or resource-group scope is inherited by every child Microsoft.Network resource. The role grants the Microsoft.Network/* control-plane wildcard plus deployment, classic alert, support, resource-health-read, authorization-read, and resource-group-read Actions. It has no DataActions.
What permissions does the Network Contributor Azure role grant?
The role definition grants 7 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; Microsoft.Network/*; Microsoft.ResourceHealth/availabilityStatuses/read; Microsoft.Resources/deployments/*; and Microsoft.Resources/subscriptions/resourceGroups/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Network Contributor Azure role?
Key considerations when assigning Network Contributor: Microsoft.Network/* can create, change, or delete every current network resource type under that provider in scope, including resources that enforce connectivity and network security boundaries.; A compromised principal can cause widespread outage, isolation, or unintended exposure across every inheriting child network resource.; and The absence of DataActions and virtual-machine permissions does not make this role low risk; its broad control-plane wildcard remains highly privileged.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Networking →
Supports: Description, Practical scope, Common use cases, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.
- What is Azure role-based access control (Azure RBAC)? →
Supports: Practical scope, Security considerations. Retrieved 2026-07-16.
- Create, change, or delete an Azure virtual network →
Supports: Description, Common use cases, Prerequisites, Best practices. Retrieved 2026-07-16.