Azure Databases built-in role

Redis Cache Contributor

Creates and manages Azure Cache for Redis resources through the control plane but cannot read or write values stored in the cache. It has no DataActions; Redis command and key access is configured separately through access keys or Microsoft Entra-backed data access policies.

Control-plane actions (8)

• Microsoft.Authorization/*/read
• Microsoft.Cache/register/action
• Microsoft.Cache/redis/*
• Microsoft.Insights/alertRules/*
• Microsoft.ResourceHealth/availabilityStatuses/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Support/*

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on an existing Azure Cache for Redis resource or its dedicated resource group for lifecycle administration. Parent-scope assignments are inherited by every cache below them. This role governs cache infrastructure, not Redis users, commands, keys, or values.

Common use cases (2)

• Create, configure, scale, monitor, or retire an Azure Cache for Redis resource while keeping cached-data access separate.
• Maintain an existing Azure Cache for Redis deployment during a planned migration to Azure Managed Redis.

Prerequisites (2)

• Identify the cache SKU, network, availability, persistence, maintenance, and retirement or migration requirements.
• Configure Microsoft Entra authentication and a Redis data access policy separately for applications or people that need cache commands.

Best practices (3)

• Plan migration to Azure Managed Redis because Microsoft has announced retirement timelines for Azure Cache for Redis SKUs.
• Use Microsoft Entra authentication and a Data Reader, Data Contributor, Data Owner, or custom Redis access policy for cache data instead of conflating data access with this management role.
• Scope the broad contributor role to the individual cache or dedicated resource group and schedule disruptive configuration changes in a maintenance window.

Security considerations (3)

• The role can create, reconfigure, scale, reboot, and delete cache resources, affecting availability, network exposure, persistence, and cost.
• It cannot directly read or write cached values and has no DataActions, but management changes can affect authentication and connectivity.
• This broad contributor role is not a least-privilege default for data access or view-only operations.

Assignment guidance

Assign Redis Cache Contributor to the infrastructure operator on the individual cache or dedicated resource group. Configure Redis data access separately, and treat the assignment as transitional where the cache is scheduled to migrate to Azure Managed Redis.

Editorial sources (6)

• Azure built-in roles for Databases →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• How to configure Azure Cache for Redis →

  Supports: Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• Configure custom data access policies for Azure Cache for Redis →

  Supports: Description, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• Azure Cache for Redis retirement FAQ →

  Supports: Common use cases, Best practices, Assignment guidance. Retrieved 2026-07-16.

Official Microsoft Learn documentation →