Azure Compute built-in role
Quantum Workspace Data Contributor
Submits, reads, and modifies Azure Quantum jobs and other workspace data without creating, deleting, or changing the workspace resource. The built-in role is preview and combines workspace control-plane reads with job DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: c1410b24-3e69-4857-8f86-4d0a2e603250
Control-plane actions (6)
Microsoft.Authorization/*/readMicrosoft.Insights/alertRules/*Microsoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.Quantum/Workspaces/readMicrosoft.Quantum/locations/offerings/read
Data-plane actions (2)
Microsoft.Quantum/Workspaces/jobs/readMicrosoft.Quantum/Workspaces/jobs/write
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign at the Azure Quantum workspace for one job boundary. A resource-group or broader assignment is inherited by all workspaces below it. Job read and write operations are data-plane permissions; workspace and offering visibility is in the control plane.
Common use cases (2)
- Allow a researcher or automation identity to submit quantum jobs and retrieve their status and results from an existing workspace.
- Let a workload team manage its job data without granting workspace lifecycle or Azure RBAC administration.
Prerequisites (2)
- An Azure Quantum workspace, associated storage, provider, target, and supported client or development kit must already be configured.
- Treat the role as preview and validate the provider, job format, target profile, quota, and expected cost before submission.
Best practices (3)
- Assign at the workspace to a group, service principal, or managed identity dedicated to the approved workload.
- Keep workspace administration and role assignment with separate principals.
- Review jobs, provider targets, output storage, and assignment membership because role changes can take time to propagate.
Security considerations (3)
- The DataActions allow reading job inputs, outputs, status, and other workspace data and submitting workloads that can incur provider charges.
- The role does not create or modify the workspace, but it can change or add job data within it.
- Preview behavior and permissions can change; reassess before production or regulated use.
Assignment guidance
Assign Quantum Workspace Data Contributor on the individual workspace to identities that submit and inspect jobs. Keep Contributor or Owner separate for workspace lifecycle and access administration, and review the preview definition before expanding scope.
Related roles (2)
- Contributor: Microsoft documents Contributor for workspace management, while Quantum Workspace Data Contributor handles jobs without workspace modification.
- Reader: Microsoft documents Reader for resource visibility without job submission or workspace changes.
Common questions
When should I assign the Quantum Workspace Data Contributor Azure role?
Assign Quantum Workspace Data Contributor when you need to: Allow a researcher or automation identity to submit quantum jobs and retrieve their status and results from an existing workspace.; and Let a workload team manage its job data without granting workspace lifecycle or Azure RBAC administration.. Practical scope: Assign at the Azure Quantum workspace for one job boundary. A resource-group or broader assignment is inherited by all workspaces below it. Job read and write operations are data-plane permissions; workspace and offering visibility is in the control plane.
What permissions does the Quantum Workspace Data Contributor Azure role grant?
The role definition grants 8 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; Microsoft.Resources/deployments/*; Microsoft.Resources/subscriptions/resourceGroups/read; Microsoft.Quantum/Workspaces/read; and Microsoft.Quantum/locations/offerings/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Quantum Workspace Data Contributor Azure role?
Key considerations when assigning Quantum Workspace Data Contributor: The DataActions allow reading job inputs, outputs, status, and other workspace data and submitting workloads that can incur provider charges.; The role does not create or modify the workspace, but it can change or add job data within it.; and Preview behavior and permissions can change; reassess before production or regulated use.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Compute →
Supports: Description, Practical scope. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Understanding Azure Quantum workspace access →
Supports: Description, Practical scope, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Submit Q# programs to Azure Quantum →
Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.