Azure DevOps built-in role
Playwright Workspace Reader
Views Playwright workspace resources and test results without changing the workspace, creating or deleting access tokens, or running tests. The published definition contains control-plane read Actions only and no DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 19d36063-d00b-4ea5-a1ac-a7c4926a0b78
Control-plane actions (4)
Microsoft.Loadtestservice/playwrightworkspaces/*/readMicrosoft.Loadtestservice/locations/playwrightquotas/*/readMicrosoft.Authorization/*/readMicrosoft.Resources/subscriptions/resourceGroups/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign directly on the Playwright workspace. Resource-group or subscription assignments are inherited by every workspace below them and broaden both workspace and test-result visibility.
Common use cases (2)
- Let an application owner, release reviewer, or auditor inspect Playwright test results without executing tests.
- Give a stakeholder read-only portal visibility into one Playwright workspace.
Prerequisites (2)
- The Playwright workspace and test results to review must already exist.
- The principal must be a user, group, or service principal approved to view the workspace results.
Best practices (3)
- Assign Reader directly on one workspace and use Microsoft Entra security groups for team-based access lifecycle.
- Do not enable or distribute workspace access tokens for a reader-only workflow because Reader cannot run tests with them.
- Use Contributor only when the principal must configure or execute tests.
Security considerations (3)
- The role exposes workspace configuration and test results throughout the assigned scope.
- It cannot run Playwright tests or create and delete workspace access tokens.
- A broader parent assignment exposes every inherited Playwright workspace and its results.
Assignment guidance
Assign Playwright Workspace Reader directly on the workspace to result consumers and reviewers. Keep access-token authentication disabled for reader-only use and elevate to Contributor only for approved quota, assignee access-token, or test-run operations, not for workspace writes.
Related roles (2)
- Playwright Workspace Contributor: Adds quota, assignee access-token, and test-run operations while retaining workspace read-only Actions.
- Playwright Workspace Owner: Adds full workspace lifecycle operations and is the broadest Playwright workspace role.
Common questions
When should I assign the Playwright Workspace Reader Azure role?
Assign Playwright Workspace Reader when you need to: Let an application owner, release reviewer, or auditor inspect Playwright test results without executing tests.; and Give a stakeholder read-only portal visibility into one Playwright workspace.. Practical scope: Assign directly on the Playwright workspace. Resource-group or subscription assignments are inherited by every workspace below them and broaden both workspace and test-result visibility.
What permissions does the Playwright Workspace Reader Azure role grant?
The role definition grants 4 combined control-plane and data-plane actions. Representative operations include: Microsoft.Loadtestservice/playwrightworkspaces/*/read; Microsoft.Loadtestservice/locations/playwrightquotas/*/read; Microsoft.Authorization/*/read; and Microsoft.Resources/subscriptions/resourceGroups/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Playwright Workspace Reader Azure role?
Key considerations when assigning Playwright Workspace Reader: The role exposes workspace configuration and test results throughout the assigned scope.; It cannot run Playwright tests or create and delete workspace access tokens.; and A broader parent assignment exposes every inherited Playwright workspace and its results.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (8)
- Azure built-in roles for DevOps - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-17.
- Manage workspace access - Playwright Workspaces | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Manage workspace access tokens - Playwright Workspaces | Microsoft Learn →
Supports: Best practices, Security considerations. Retrieved 2026-07-17.
- Playwright Workspaces authentication - Playwright Workspaces | Microsoft Learn →
Supports: Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.