Azure Networking built-in role
Traffic Manager Contributor
Manages Azure Traffic Manager profiles through the Microsoft.Network/trafficManagerProfiles/* control plane but cannot create Azure RBAC role assignments. The role can configure profiles, endpoints, routing, and health monitoring and has no DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: a4b10055-b0c7-44c2-b00f-c7b5b3550cf7
Control-plane actions (7)
Microsoft.Authorization/*/readMicrosoft.Insights/alertRules/*Microsoft.Network/trafficManagerProfiles/*Microsoft.ResourceHealth/availabilityStatuses/readMicrosoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.Support/*
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
The built-in definition is available throughout the Azure hierarchy. Assign it at the Traffic Manager profile or dedicated resource group when possible; parent-scope assignments are inherited by child profile resources. Its permissions are control-plane Actions for Traffic Manager profiles plus deployments, classic alerts, support, resource health reads, authorization reads, and resource-group reads.
Common use cases (2)
- Create and manage Traffic Manager profiles, endpoints, routing methods, and DNS-based failover configuration for an approved application.
- Operate profile enablement, endpoint health settings, and controlled traffic-shift or migration workflows across Azure and external endpoints.
Prerequisites (3)
- Identify the application endpoints, routing method, health-probe protocol, port, path, expected status codes, timeout, and DNS TTL before granting profile management.
- Ensure firewalls or access-control lists allow Traffic Manager health probes, preferably through the AzureTrafficManager service tag where supported.
- The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target profile or resource-group scope.
Best practices (3)
- Scope the role to an individual profile or dedicated resource group rather than a subscription when the operator manages one application.
- Use an application-specific health endpoint, verify the profile reports Online rather than Degraded, and test failover behavior before production changes.
- Review routing method, endpoint state, health thresholds, and DNS TTL together because DNS caching affects how quickly traffic shifts reach clients.
Security considerations (3)
- A profile change can redirect new client connections, disable an endpoint, alter geographic or weighted routing, or return no usable endpoint.
- Misconfigured health probes can mark healthy endpoints degraded or hide failed failover behavior; when all eligible endpoints are degraded, Traffic Manager can return them on a best-effort basis.
- The role has no DataActions and does not manage the endpoint application itself, but DNS routing authority can still cause widespread outage or unintended traffic placement.
Assignment guidance
Assign Traffic Manager Contributor to the operations team or automation identity responsible for a defined profile, preferably at that profile or its dedicated resource group. Require reviewed routing and health-probe settings, test DNS failover and cache behavior, and grant endpoint-application permissions separately.
Common questions
When should I assign the Traffic Manager Contributor Azure role?
Assign Traffic Manager Contributor when you need to: Create and manage Traffic Manager profiles, endpoints, routing methods, and DNS-based failover configuration for an approved application.; and Operate profile enablement, endpoint health settings, and controlled traffic-shift or migration workflows across Azure and external endpoints.. Practical scope: The built-in definition is available throughout the Azure hierarchy. Assign it at the Traffic Manager profile or dedicated resource group when possible; parent-scope assignments are inherited by child profile resources. Its permissions are control-plane Actions for Traffic Manager profiles plus deployments, classic alerts, support, resource health reads, authorization reads, and resource-group reads.
What permissions does the Traffic Manager Contributor Azure role grant?
The role definition grants 7 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; Microsoft.Network/trafficManagerProfiles/*; Microsoft.ResourceHealth/availabilityStatuses/read; Microsoft.Resources/deployments/*; and Microsoft.Resources/subscriptions/resourceGroups/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Traffic Manager Contributor Azure role?
Key considerations when assigning Traffic Manager Contributor: A profile change can redirect new client connections, disable an endpoint, alter geographic or weighted routing, or return no usable endpoint.; Misconfigured health probes can mark healthy endpoints degraded or hide failed failover behavior; when all eligible endpoints are degraded, Traffic Manager can return them on a best-effort basis.; and The role has no DataActions and does not manage the endpoint application itself, but DNS routing authority can still cause widespread outage or unintended traffic placement.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (8)
- Azure built-in roles for Networking →
Supports: Description, Practical scope, Security considerations, Assignment guidance. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-16.
- What is Azure role-based access control (Azure RBAC)? →
Supports: Practical scope. Retrieved 2026-07-16.
- How Azure Traffic Manager works →
Supports: Description, Common use cases, Best practices, Security considerations. Retrieved 2026-07-16.
- Manage Azure Traffic Manager profiles →
Supports: Common use cases. Retrieved 2026-07-16.
- Azure Traffic Manager endpoint monitoring →
Supports: Description, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.