Azure Privileged built-in role

Role Based Access Control Administrator

Manages Azure RBAC access by creating and deleting role assignments. It can assign Owner to itself or others, reads control-plane information for all Azure resource types, and does not manage non-RBAC access mechanisms such as Azure Policy.

Control-plane actions (4)

• Microsoft.Authorization/roleAssignments/write
• Microsoft.Authorization/roleAssignments/delete
• */read
• Microsoft.Support/*

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The built-in definition is available throughout the Azure hierarchy. The assignment governs Azure RBAC access at the selected scope and inherited child scopes. It includes control-plane read and role-assignment actions but no DataActions, so it does not directly grant workload data access.

Common use cases (2)

• Delegate Azure RBAC role-assignment administration without granting broad resource-write permissions.
• Constrain a delegate to assigning selected roles to selected principal types or principals by applying an Azure RBAC condition.

Prerequisites (2)

• Define which roles the delegate may assign or remove, which principal types or principals are allowed, and the narrowest delegation scope.
• The administrator creating this assignment needs Microsoft.Authorization/roleAssignments/write at the target scope.

Best practices (3)

• Prefer this role over Owner or User Access Administrator when the task is specifically Azure RBAC delegation.
• Add a condition that limits assignable roles and principals rather than granting unrestricted role-assignment authority.
• Use a narrow scope, eligible PIM access for human delegates where available, and periodic assignment reviews.

Security considerations (3)

• Without a condition, the assignee can grant Owner to itself or another principal at the assigned scope.
• Assignments at parent scopes affect all inheriting children, so a broad scope magnifies escalation risk.
• The role reads control-plane information for all resource types but has no DataActions and no general resource-write grant.

Assignment guidance

Use this as the preferred built-in role for Azure RBAC delegation, then constrain it with role-assignment conditions and the narrowest scope. Use User Access Administrator only when its broader Microsoft.Authorization permissions are actually required. For people, prefer an eligible or time-bound PIM assignment.

Related roles (2)

• User Access Administrator: Broader access-administration role; Microsoft identifies RBAC Administrator as having fewer permissions for constrained delegation.
• Owner: Combines access delegation with unrestricted resource management.

Editorial sources (6)

• Azure built-in roles for Privileged →

  Supports: Description, Practical scope. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Description, Prerequisites, Security considerations, Related roles. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Security considerations. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Eligible and time-bound role assignments in Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Delegate Azure role assignment management to others with conditions →

  Supports: Description, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →