Azure DevOps built-in role
Playwright Workspace Contributor
Reads Playwright workspace resources, performs Playwright quota operations, creates and deletes the assignee's workspace access tokens, and runs Playwright tests. The product access page describes Contributor as having full portal management, but the published built-in role definition exposes no Playwright workspace write Action; this record therefore represents only the verified intersection. All published permissions are control-plane Actions, with no DataActions or Azure role-assignment write.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 78cf819f-0969-4ebe-8759-015c6efcd5bf
Control-plane actions (7)
Microsoft.Loadtestservice/playwrightworkspaces/*/readMicrosoft.Loadtestservice/locations/playwrightquotas/*Microsoft.Loadtestservice/playwrightworkspaces/AccessTokens/*Microsoft.Loadtestservice/playwrightworkspaces/TestRuns/*Microsoft.Authorization/*/readMicrosoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign directly on the Playwright workspace. A resource-group or subscription assignment is inherited by every Playwright workspace below it, broadening workspace visibility, quota operations, access-token operations, and test-run authority.
Common use cases (2)
- Let a developer or CI service principal inspect one workspace and execute end-to-end tests at scale without granting workspace write operations.
- Allow a workspace user to create and revoke the user's own limited-lifetime access tokens when Microsoft Entra authentication cannot be used.
Prerequisites (2)
- A Playwright workspace must exist and the principal must be a user, group, or service principal selected for that workspace.
- Configure Microsoft Entra authentication for the test runner, or explicitly enable access-token authentication before issuing a token.
Best practices (3)
- Use Microsoft Entra ID as the default authentication method and keep access-token authentication disabled unless a reviewed workflow requires it.
- Treat workspace access tokens as passwords: do not share, hard-code, or store them in plaintext, and revoke and recreate a compromised token.
- Use Reader for users who only inspect results and keep Azure RBAC delegation on a separate access-administration role.
Security considerations (3)
- Contributor can execute tests and create workspace access tokens, so compromise can authorize service use until the token expires or is revoked.
- Tokens are associated with a user and workspace, and the service checks that user's Azure RBAC role when the token is used.
- The published definition includes quota, access-token, and test-run Actions but no Playwright workspace write Action, no Azure role-assignment write, and no DataActions.
Assignment guidance
Assign Playwright Workspace Contributor directly on one workspace to test authors or CI identities that need workspace reads, quota operations, their own access-token operations, or test execution. Prefer Microsoft Entra authentication, use Reader for result-only access, and grant workspace write or Azure role-assignment authority separately when independently required.
Related roles (2)
- Playwright Workspace Reader: Views workspace and test results without running tests or managing access tokens.
- Playwright Workspace Owner: Adds Playwright workspace write and delete operations to Contributor's workspace-read, quota, own-token, and test-run operations.
Common questions
When should I assign the Playwright Workspace Contributor Azure role?
Assign Playwright Workspace Contributor when you need to: Let a developer or CI service principal inspect one workspace and execute end-to-end tests at scale without granting workspace write operations.; and Allow a workspace user to create and revoke the user's own limited-lifetime access tokens when Microsoft Entra authentication cannot be used.. Practical scope: Assign directly on the Playwright workspace. A resource-group or subscription assignment is inherited by every Playwright workspace below it, broadening workspace visibility, quota operations, access-token operations, and test-run authority.
What permissions does the Playwright Workspace Contributor Azure role grant?
The role definition grants 7 combined control-plane and data-plane actions. Representative operations include: Microsoft.Loadtestservice/playwrightworkspaces/*/read; Microsoft.Loadtestservice/locations/playwrightquotas/*; Microsoft.Loadtestservice/playwrightworkspaces/AccessTokens/*; Microsoft.Loadtestservice/playwrightworkspaces/TestRuns/*; Microsoft.Authorization/*/read; and Microsoft.Resources/deployments/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Playwright Workspace Contributor Azure role?
Key considerations when assigning Playwright Workspace Contributor: Contributor can execute tests and create workspace access tokens, so compromise can authorize service use until the token expires or is revoked.; Tokens are associated with a user and workspace, and the service checks that user's Azure RBAC role when the token is used.; and The published definition includes quota, access-token, and test-run Actions but no Playwright workspace write Action, no Azure role-assignment write, and no DataActions.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (8)
- Azure built-in roles for DevOps - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-17.
- Manage workspace access - Playwright Workspaces | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Manage workspace access tokens - Playwright Workspaces | Microsoft Learn →
Supports: Best practices, Security considerations. Retrieved 2026-07-17.
- Playwright Workspaces authentication - Playwright Workspaces | Microsoft Learn →
Supports: Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.