Azure DevOps built-in role

Playwright Workspace Contributor

Reads Playwright workspace resources, performs Playwright quota operations, creates and deletes the assignee's workspace access tokens, and runs Playwright tests. The product access page describes Contributor as having full portal management, but the published built-in role definition exposes no Playwright workspace write Action; this record therefore represents only the verified intersection. All published permissions are control-plane Actions, with no DataActions or Azure role-assignment write.

Control-plane actions (7)

• Microsoft.Loadtestservice/playwrightworkspaces/*/read
• Microsoft.Loadtestservice/locations/playwrightquotas/*
• Microsoft.Loadtestservice/playwrightworkspaces/AccessTokens/*
• Microsoft.Loadtestservice/playwrightworkspaces/TestRuns/*
• Microsoft.Authorization/*/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign directly on the Playwright workspace. A resource-group or subscription assignment is inherited by every Playwright workspace below it, broadening workspace visibility, quota operations, access-token operations, and test-run authority.

Common use cases (2)

• Let a developer or CI service principal inspect one workspace and execute end-to-end tests at scale without granting workspace write operations.
• Allow a workspace user to create and revoke the user's own limited-lifetime access tokens when Microsoft Entra authentication cannot be used.

Prerequisites (2)

• A Playwright workspace must exist and the principal must be a user, group, or service principal selected for that workspace.
• Configure Microsoft Entra authentication for the test runner, or explicitly enable access-token authentication before issuing a token.

Best practices (3)

• Use Microsoft Entra ID as the default authentication method and keep access-token authentication disabled unless a reviewed workflow requires it.
• Treat workspace access tokens as passwords: do not share, hard-code, or store them in plaintext, and revoke and recreate a compromised token.
• Use Reader for users who only inspect results and keep Azure RBAC delegation on a separate access-administration role.

Security considerations (3)

• Contributor can execute tests and create workspace access tokens, so compromise can authorize service use until the token expires or is revoked.
• Tokens are associated with a user and workspace, and the service checks that user's Azure RBAC role when the token is used.
• The published definition includes quota, access-token, and test-run Actions but no Playwright workspace write Action, no Azure role-assignment write, and no DataActions.

Assignment guidance

Assign Playwright Workspace Contributor directly on one workspace to test authors or CI identities that need workspace reads, quota operations, their own access-token operations, or test execution. Prefer Microsoft Entra authentication, use Reader for result-only access, and grant workspace write or Azure role-assignment authority separately when independently required.

Related roles (2)

• Playwright Workspace Reader: Views workspace and test results without running tests or managing access tokens.
• Playwright Workspace Owner: Adds Playwright workspace write and delete operations to Contributor's workspace-read, quota, own-token, and test-run operations.

Editorial sources (8)

• Azure built-in roles for DevOps - Azure RBAC | Microsoft Learn →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-17.

• Manage workspace access - Playwright Workspaces | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Manage workspace access tokens - Playwright Workspaces | Microsoft Learn →

  Supports: Best practices, Security considerations. Retrieved 2026-07-17.

• Playwright Workspaces authentication - Playwright Workspaces | Microsoft Learn →

  Supports: Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

Official Microsoft Learn documentation →