Azure DevOps built-in role
Playwright Workspace Owner
Performs all published Playwright workspace resource, quota, access-token, and test-run operations. The role uses control-plane Actions only and has no DataActions; the published machine definition does not include Microsoft.Authorization/roleAssignments/write.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 45265627-32f7-4da4-9ab0-b1cb0e9ec70b
Control-plane actions (5)
Microsoft.Loadtestservice/playwrightworkspaces/*Microsoft.Loadtestservice/locations/playwrightquotas/*Microsoft.Authorization/*/readMicrosoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign directly on the Playwright workspace unless the same trusted platform owner manages every inherited workspace. A parent-scope assignment broadens workspace lifecycle, token, quota, and test-run authority.
Common use cases (2)
- Give a trusted platform owner full lifecycle control over one Playwright workspace and its tests and authentication settings.
- Create, update, or delete the workspace in addition to running tests and managing the owner's workspace access tokens.
Prerequisites (2)
- Confirm the principal needs workspace resource lifecycle authority rather than the narrower Contributor or Reader role.
- A principal that assigns Azure roles still needs a role with Microsoft.Authorization/roleAssignments/write at the workspace or parent scope.
Best practices (3)
- Keep the number of workspace owners small and use Contributor for test authors who do not manage the workspace lifecycle.
- Prefer Microsoft Entra ID authentication and keep access-token authentication disabled unless required.
- Manage team membership with Microsoft Entra security groups rather than distributing workspace access tokens.
Security considerations (3)
- The role can delete or reconfigure the workspace, execute tests, and create access tokens that function like passwords for the workspace.
- A token remains associated with the owner identity and is checked against current Azure RBAC at use time, but must still be protected and revoked if compromised.
- The workspace access guide describes Owner as able to assign roles, but the published role definition lacks role-assignment write; verify and grant that authority separately instead of relying on the title.
Assignment guidance
Assign Playwright Workspace Owner directly on one workspace only to the platform owner responsible for its lifecycle. Use Contributor for workspace reads, quota operations, the assignee's access-token operations, and test execution without workspace write; use Reader for results, and a separate access-administration role when Azure role assignments must be created.
Related roles (2)
- Playwright Workspace Contributor: Reads the workspace and performs quota, assignee access-token, and test-run operations without the Owner workspace write and delete Actions.
- User Access Administrator: Microsoft lists User Access Administrator as a role that supplies the separate Azure role-assignment authority required to grant workspace access.
Common questions
When should I assign the Playwright Workspace Owner Azure role?
Assign Playwright Workspace Owner when you need to: Give a trusted platform owner full lifecycle control over one Playwright workspace and its tests and authentication settings.; and Create, update, or delete the workspace in addition to running tests and managing the owner's workspace access tokens.. Practical scope: Assign directly on the Playwright workspace unless the same trusted platform owner manages every inherited workspace. A parent-scope assignment broadens workspace lifecycle, token, quota, and test-run authority.
What permissions does the Playwright Workspace Owner Azure role grant?
The role definition grants 5 combined control-plane and data-plane actions. Representative operations include: Microsoft.Loadtestservice/playwrightworkspaces/*; Microsoft.Loadtestservice/locations/playwrightquotas/*; Microsoft.Authorization/*/read; Microsoft.Resources/deployments/*; and Microsoft.Resources/subscriptions/resourceGroups/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Playwright Workspace Owner Azure role?
Key considerations when assigning Playwright Workspace Owner: The role can delete or reconfigure the workspace, execute tests, and create access tokens that function like passwords for the workspace.; A token remains associated with the owner identity and is checked against current Azure RBAC at use time, but must still be protected and revoked if compromised.; and The workspace access guide describes Owner as able to assign roles, but the published role definition lacks role-assignment write; verify and grant that authority separately instead of relying on the title.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (8)
- Azure built-in roles for DevOps - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-17.
- Manage workspace access - Playwright Workspaces | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Manage workspace access tokens - Playwright Workspaces | Microsoft Learn →
Supports: Best practices, Security considerations. Retrieved 2026-07-17.
- Playwright Workspaces authentication - Playwright Workspaces | Microsoft Learn →
Supports: Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.