Azure DevOps built-in role

Playwright Workspace Reader

Views Playwright workspace resources and test results without changing the workspace, creating or deleting access tokens, or running tests. The published definition contains control-plane read Actions only and no DataActions.

Control-plane actions (4)

• Microsoft.Loadtestservice/playwrightworkspaces/*/read
• Microsoft.Loadtestservice/locations/playwrightquotas/*/read
• Microsoft.Authorization/*/read
• Microsoft.Resources/subscriptions/resourceGroups/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign directly on the Playwright workspace. Resource-group or subscription assignments are inherited by every workspace below them and broaden both workspace and test-result visibility.

Common use cases (2)

• Let an application owner, release reviewer, or auditor inspect Playwright test results without executing tests.
• Give a stakeholder read-only portal visibility into one Playwright workspace.

Prerequisites (2)

• The Playwright workspace and test results to review must already exist.
• The principal must be a user, group, or service principal approved to view the workspace results.

Best practices (3)

• Assign Reader directly on one workspace and use Microsoft Entra security groups for team-based access lifecycle.
• Do not enable or distribute workspace access tokens for a reader-only workflow because Reader cannot run tests with them.
• Use Contributor only when the principal must configure or execute tests.

Security considerations (3)

• The role exposes workspace configuration and test results throughout the assigned scope.
• It cannot run Playwright tests or create and delete workspace access tokens.
• A broader parent assignment exposes every inherited Playwright workspace and its results.

Assignment guidance

Assign Playwright Workspace Reader directly on the workspace to result consumers and reviewers. Keep access-token authentication disabled for reader-only use and elevate to Contributor only for approved quota, assignee access-token, or test-run operations, not for workspace writes.

Related roles (2)

• Playwright Workspace Contributor: Adds quota, assignee access-token, and test-run operations while retaining workspace read-only Actions.
• Playwright Workspace Owner: Adds full workspace lifecycle operations and is the broadest Playwright workspace role.

Editorial sources (8)

• Azure built-in roles for DevOps - Azure RBAC | Microsoft Learn →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-17.

• Manage workspace access - Playwright Workspaces | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Manage workspace access tokens - Playwright Workspaces | Microsoft Learn →

  Supports: Best practices, Security considerations. Retrieved 2026-07-17.

• Playwright Workspaces authentication - Playwright Workspaces | Microsoft Learn →

  Supports: Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

Official Microsoft Learn documentation →