Azure Databases built-in role
Redis Cache Contributor
Creates and manages Azure Cache for Redis resources through the control plane but cannot read or write values stored in the cache. It has no DataActions; Redis command and key access is configured separately through access keys or Microsoft Entra-backed data access policies.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: e0f68234-74aa-48ed-b826-c38b57376e17
Control-plane actions (8)
Microsoft.Authorization/*/readMicrosoft.Cache/register/actionMicrosoft.Cache/redis/*Microsoft.Insights/alertRules/*Microsoft.ResourceHealth/availabilityStatuses/readMicrosoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.Support/*
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on an existing Azure Cache for Redis resource or its dedicated resource group for lifecycle administration. Parent-scope assignments are inherited by every cache below them. This role governs cache infrastructure, not Redis users, commands, keys, or values.
Common use cases (2)
- Create, configure, scale, monitor, or retire an Azure Cache for Redis resource while keeping cached-data access separate.
- Maintain an existing Azure Cache for Redis deployment during a planned migration to Azure Managed Redis.
Prerequisites (2)
- Identify the cache SKU, network, availability, persistence, maintenance, and retirement or migration requirements.
- Configure Microsoft Entra authentication and a Redis data access policy separately for applications or people that need cache commands.
Best practices (3)
- Plan migration to Azure Managed Redis because Microsoft has announced retirement timelines for Azure Cache for Redis SKUs.
- Use Microsoft Entra authentication and a Data Reader, Data Contributor, Data Owner, or custom Redis access policy for cache data instead of conflating data access with this management role.
- Scope the broad contributor role to the individual cache or dedicated resource group and schedule disruptive configuration changes in a maintenance window.
Security considerations (3)
- The role can create, reconfigure, scale, reboot, and delete cache resources, affecting availability, network exposure, persistence, and cost.
- It cannot directly read or write cached values and has no DataActions, but management changes can affect authentication and connectivity.
- This broad contributor role is not a least-privilege default for data access or view-only operations.
Assignment guidance
Assign Redis Cache Contributor to the infrastructure operator on the individual cache or dedicated resource group. Configure Redis data access separately, and treat the assignment as transitional where the cache is scheduled to migrate to Azure Managed Redis.
Common questions
When should I assign the Redis Cache Contributor Azure role?
Assign Redis Cache Contributor when you need to: Create, configure, scale, monitor, or retire an Azure Cache for Redis resource while keeping cached-data access separate.; and Maintain an existing Azure Cache for Redis deployment during a planned migration to Azure Managed Redis.. Practical scope: Assign on an existing Azure Cache for Redis resource or its dedicated resource group for lifecycle administration. Parent-scope assignments are inherited by every cache below them. This role governs cache infrastructure, not Redis users, commands, keys, or values.
What permissions does the Redis Cache Contributor Azure role grant?
The role definition grants 8 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Cache/register/action; Microsoft.Cache/redis/*; Microsoft.Insights/alertRules/*; Microsoft.ResourceHealth/availabilityStatuses/read; and Microsoft.Resources/deployments/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Redis Cache Contributor Azure role?
Key considerations when assigning Redis Cache Contributor: The role can create, reconfigure, scale, reboot, and delete cache resources, affecting availability, network exposure, persistence, and cost.; It cannot directly read or write cached values and has no DataActions, but management changes can affect authentication and connectivity.; and This broad contributor role is not a least-privilege default for data access or view-only operations.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Databases →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-16.
- How to configure Azure Cache for Redis →
Supports: Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance. Retrieved 2026-07-16.
- Configure custom data access policies for Azure Cache for Redis →
Supports: Description, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.
- Azure Cache for Redis retirement FAQ →
Supports: Common use cases, Best practices, Assignment guidance. Retrieved 2026-07-16.