Azure Privileged built-in role
Role Based Access Control Administrator
Manages Azure RBAC access by creating and deleting role assignments. It can assign Owner to itself or others, reads control-plane information for all Azure resource types, and does not manage non-RBAC access mechanisms such as Azure Policy.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: f58310d9-a9f6-439a-9e8d-f62e7b41a168
Control-plane actions (4)
Microsoft.Authorization/roleAssignments/writeMicrosoft.Authorization/roleAssignments/delete*/readMicrosoft.Support/*
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
The built-in definition is available throughout the Azure hierarchy. The assignment governs Azure RBAC access at the selected scope and inherited child scopes. It includes control-plane read and role-assignment actions but no DataActions, so it does not directly grant workload data access.
Common use cases (2)
- Delegate Azure RBAC role-assignment administration without granting broad resource-write permissions.
- Constrain a delegate to assigning selected roles to selected principal types or principals by applying an Azure RBAC condition.
Prerequisites (2)
- Define which roles the delegate may assign or remove, which principal types or principals are allowed, and the narrowest delegation scope.
- The administrator creating this assignment needs Microsoft.Authorization/roleAssignments/write at the target scope.
Best practices (3)
- Prefer this role over Owner or User Access Administrator when the task is specifically Azure RBAC delegation.
- Add a condition that limits assignable roles and principals rather than granting unrestricted role-assignment authority.
- Use a narrow scope, eligible PIM access for human delegates where available, and periodic assignment reviews.
Security considerations (3)
- Without a condition, the assignee can grant Owner to itself or another principal at the assigned scope.
- Assignments at parent scopes affect all inheriting children, so a broad scope magnifies escalation risk.
- The role reads control-plane information for all resource types but has no DataActions and no general resource-write grant.
Assignment guidance
Use this as the preferred built-in role for Azure RBAC delegation, then constrain it with role-assignment conditions and the narrowest scope. Use User Access Administrator only when its broader Microsoft.Authorization permissions are actually required. For people, prefer an eligible or time-bound PIM assignment.
Related roles (2)
- User Access Administrator: Broader access-administration role; Microsoft identifies RBAC Administrator as having fewer permissions for constrained delegation.
- Owner: Combines access delegation with unrestricted resource management.
Common questions
When should I assign the Role Based Access Control Administrator Azure role?
Assign Role Based Access Control Administrator when you need to: Delegate Azure RBAC role-assignment administration without granting broad resource-write permissions.; and Constrain a delegate to assigning selected roles to selected principal types or principals by applying an Azure RBAC condition.. Practical scope: The built-in definition is available throughout the Azure hierarchy. The assignment governs Azure RBAC access at the selected scope and inherited child scopes. It includes control-plane read and role-assignment actions but no DataActions, so it does not directly grant workload data access.
What permissions does the Role Based Access Control Administrator Azure role grant?
The role definition grants 4 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/roleAssignments/write; Microsoft.Authorization/roleAssignments/delete; */read; and Microsoft.Support/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Role Based Access Control Administrator Azure role?
Key considerations when assigning Role Based Access Control Administrator: Without a condition, the assignee can grant Owner to itself or another principal at the assigned scope.; Assignments at parent scopes affect all inheriting children, so a broad scope magnifies escalation risk.; and The role reads control-plane information for all resource types but has no DataActions and no general resource-write grant.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Privileged →
Supports: Description, Practical scope. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Description, Prerequisites, Security considerations, Related roles. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Security considerations. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Eligible and time-bound role assignments in Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Delegate Azure role assignment management to others with conditions →
Supports: Description, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.