Azure DevOps built-in role

Playwright Workspace Owner

Performs all published Playwright workspace resource, quota, access-token, and test-run operations. The role uses control-plane Actions only and has no DataActions; the published machine definition does not include Microsoft.Authorization/roleAssignments/write.

Control-plane actions (5)

• Microsoft.Loadtestservice/playwrightworkspaces/*
• Microsoft.Loadtestservice/locations/playwrightquotas/*
• Microsoft.Authorization/*/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign directly on the Playwright workspace unless the same trusted platform owner manages every inherited workspace. A parent-scope assignment broadens workspace lifecycle, token, quota, and test-run authority.

Common use cases (2)

• Give a trusted platform owner full lifecycle control over one Playwright workspace and its tests and authentication settings.
• Create, update, or delete the workspace in addition to running tests and managing the owner's workspace access tokens.

Prerequisites (2)

• Confirm the principal needs workspace resource lifecycle authority rather than the narrower Contributor or Reader role.
• A principal that assigns Azure roles still needs a role with Microsoft.Authorization/roleAssignments/write at the workspace or parent scope.

Best practices (3)

• Keep the number of workspace owners small and use Contributor for test authors who do not manage the workspace lifecycle.
• Prefer Microsoft Entra ID authentication and keep access-token authentication disabled unless required.
• Manage team membership with Microsoft Entra security groups rather than distributing workspace access tokens.

Security considerations (3)

• The role can delete or reconfigure the workspace, execute tests, and create access tokens that function like passwords for the workspace.
• A token remains associated with the owner identity and is checked against current Azure RBAC at use time, but must still be protected and revoked if compromised.
• The workspace access guide describes Owner as able to assign roles, but the published role definition lacks role-assignment write; verify and grant that authority separately instead of relying on the title.

Assignment guidance

Assign Playwright Workspace Owner directly on one workspace only to the platform owner responsible for its lifecycle. Use Contributor for workspace reads, quota operations, the assignee's access-token operations, and test execution without workspace write; use Reader for results, and a separate access-administration role when Azure role assignments must be created.

Related roles (2)

• Playwright Workspace Contributor: Reads the workspace and performs quota, assignee access-token, and test-run operations without the Owner workspace write and delete Actions.
• User Access Administrator: Microsoft lists User Access Administrator as a role that supplies the separate Azure role-assignment authority required to grant workspace access.

Editorial sources (8)

• Azure built-in roles for DevOps - Azure RBAC | Microsoft Learn →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-17.

• Manage workspace access - Playwright Workspaces | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Manage workspace access tokens - Playwright Workspaces | Microsoft Learn →

  Supports: Best practices, Security considerations. Retrieved 2026-07-17.

• Playwright Workspaces authentication - Playwright Workspaces | Microsoft Learn →

  Supports: Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

Official Microsoft Learn documentation →