Azure Networking built-in role

Network Contributor

Broadly manages all Azure Resource Manager network resource types exposed through Microsoft.Network/* at the assigned scope, but cannot deploy or manage virtual machines and cannot create Azure RBAC role assignments. This is a broad privileged network control-plane role, not a least-privilege default.

Control-plane actions (7)

• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Network/*
• Microsoft.ResourceHealth/availabilityStatuses/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Support/*

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The built-in definition is available throughout the Azure hierarchy. An assignment at management-group, subscription, or resource-group scope is inherited by every child Microsoft.Network resource. The role grants the Microsoft.Network/* control-plane wildcard plus deployment, classic alert, support, resource-health-read, authorization-read, and resource-group-read Actions. It has no DataActions.

Common use cases (2)

• Administer a complete set of Azure Resource Manager network resources in a tightly bounded networking resource group when narrower roles cannot cover the required operations.
• Run network deployment automation that genuinely requires the full Microsoft.Network/* control-plane surface without Azure RBAC delegation or virtual-machine management.

Prerequisites (2)

• Inventory the network resources and dependencies the principal must change and confirm that narrower built-in or custom roles are insufficient.
• Select the smallest scope that contains those network resources; the assigning administrator needs Microsoft.Authorization/roleAssignments/write at that scope.

Best practices (3)

• Do not use Network Contributor as the default networking role; start from the exact required Actions and choose a narrower job-function or custom role when possible.
• Keep broad assignments at a dedicated networking resource group or narrower scope and review inherited management-group or subscription assignments regularly.
• Use formal change control for routing, address-space, security-boundary, connectivity, and deletion operations, and monitor the wildcard definition as Microsoft.Network adds operations.

Security considerations (3)

• Microsoft.Network/* can create, change, or delete every current network resource type under that provider in scope, including resources that enforce connectivity and network security boundaries.
• A compromised principal can cause widespread outage, isolation, or unintended exposure across every inheriting child network resource.
• The absence of DataActions and virtual-machine permissions does not make this role low risk; its broad control-plane wildcard remains highly privileged.

Assignment guidance

Reserve Network Contributor for trusted network administrators or automation that demonstrably needs the full Microsoft.Network/* control plane. Never call it least privilege. Prefer a dedicated networking resource group or resource scope, document why narrower roles are insufficient, and review the assignment and wildcard exposure regularly.

Editorial sources (6)

• Azure built-in roles for Networking →

  Supports: Description, Practical scope, Common use cases, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• What is Azure role-based access control (Azure RBAC)? →

  Supports: Practical scope, Security considerations. Retrieved 2026-07-16.

• Create, change, or delete an Azure virtual network →

  Supports: Description, Common use cases, Prerequisites, Best practices. Retrieved 2026-07-16.

Official Microsoft Learn documentation →