Azure Management and governance built-in role
Template Spec Contributor
Creates, updates, versions, and deletes Azure Resource Manager template specs at the assigned scope. It manages the stored infrastructure templates but does not by itself grant the permissions required to deploy the resources described by those templates.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 1c9b6475-caf0-4164-b5a1-2142a7116f4b
Control-plane actions (4)
Microsoft.Resources/templateSpecs/*Microsoft.Authorization/*/readMicrosoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Azure RBAC assignments apply at the selected scope and are inherited by child scopes. Keep the assignment at the narrowest resource, resource group, subscription, or management-group boundary that contains the intended resources. Template specs are stored in resource groups. Assign on the template spec or its dedicated library resource group; a broader assignment permits changes to every inherited template spec.
Common use cases (2)
- Publish and version canonical ARM template or compiled Bicep artifacts for organizational reuse.
- Maintain linked templates and release approved infrastructure definitions through a central template-spec library.
Prerequisites (2)
- Prepare and validate the ARM JSON content, linked templates, versioning convention, owners, and release process.
- Deployment principals need Template Spec Reader plus separate deployment permissions at the target scope.
Best practices (2)
- Use a dedicated library resource group, immutable versioning practices, code review, and what-if validation before publication.
- Separate template publication from production deployment authority and grant consumers read access only.
Security considerations (2)
- A compromised publisher can alter trusted infrastructure code consumed by many deployment pipelines.
- The role does not deploy target resources by itself, but published templates can request highly privileged changes when used by a separately authorized deployment identity.
Assignment guidance
Assign to the infrastructure-template publishing team at the template spec or dedicated library resource group. Use Reader for consumers and grant deployment rights only at each target scope.
Related roles (1)
- Template Spec Reader: Reads and consumes template specs without modifying the library.
Common questions
When should I assign the Template Spec Contributor Azure role?
Assign Template Spec Contributor when you need to: Publish and version canonical ARM template or compiled Bicep artifacts for organizational reuse.; and Maintain linked templates and release approved infrastructure definitions through a central template-spec library.. Practical scope: Azure RBAC assignments apply at the selected scope and are inherited by child scopes. Keep the assignment at the narrowest resource, resource group, subscription, or management-group boundary that contains the intended resources. Template specs are stored in resource groups. Assign on the template spec or its dedicated library resource group; a broader assignment permits changes to every inherited template spec.
What permissions does the Template Spec Contributor Azure role grant?
The role definition grants 4 combined control-plane and data-plane actions. Representative operations include: Microsoft.Resources/templateSpecs/*; Microsoft.Authorization/*/read; Microsoft.Resources/deployments/*; and Microsoft.Resources/subscriptions/resourceGroups/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Template Spec Contributor Azure role?
Key considerations when assigning Template Spec Contributor: A compromised publisher can alter trusted infrastructure code consumed by many deployment pipelines.; and The role does not deploy target resources by itself, but published templates can request highly privileged changes when used by a separately authorized deployment identity.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for Management and governance →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Azure Resource Manager template specs →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.