Azure Networking built-in role

Traffic Manager Contributor

Manages Azure Traffic Manager profiles through the Microsoft.Network/trafficManagerProfiles/* control plane but cannot create Azure RBAC role assignments. The role can configure profiles, endpoints, routing, and health monitoring and has no DataActions.

Control-plane actions (7)

• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Network/trafficManagerProfiles/*
• Microsoft.ResourceHealth/availabilityStatuses/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Support/*

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The built-in definition is available throughout the Azure hierarchy. Assign it at the Traffic Manager profile or dedicated resource group when possible; parent-scope assignments are inherited by child profile resources. Its permissions are control-plane Actions for Traffic Manager profiles plus deployments, classic alerts, support, resource health reads, authorization reads, and resource-group reads.

Common use cases (2)

• Create and manage Traffic Manager profiles, endpoints, routing methods, and DNS-based failover configuration for an approved application.
• Operate profile enablement, endpoint health settings, and controlled traffic-shift or migration workflows across Azure and external endpoints.

Prerequisites (3)

• Identify the application endpoints, routing method, health-probe protocol, port, path, expected status codes, timeout, and DNS TTL before granting profile management.
• Ensure firewalls or access-control lists allow Traffic Manager health probes, preferably through the AzureTrafficManager service tag where supported.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target profile or resource-group scope.

Best practices (3)

• Scope the role to an individual profile or dedicated resource group rather than a subscription when the operator manages one application.
• Use an application-specific health endpoint, verify the profile reports Online rather than Degraded, and test failover behavior before production changes.
• Review routing method, endpoint state, health thresholds, and DNS TTL together because DNS caching affects how quickly traffic shifts reach clients.

Security considerations (3)

• A profile change can redirect new client connections, disable an endpoint, alter geographic or weighted routing, or return no usable endpoint.
• Misconfigured health probes can mark healthy endpoints degraded or hide failed failover behavior; when all eligible endpoints are degraded, Traffic Manager can return them on a best-effort basis.
• The role has no DataActions and does not manage the endpoint application itself, but DNS routing authority can still cause widespread outage or unintended traffic placement.

Assignment guidance

Assign Traffic Manager Contributor to the operations team or automation identity responsible for a defined profile, preferably at that profile or its dedicated resource group. Require reviewed routing and health-probe settings, test DNS failover and cache behavior, and grant endpoint-application permissions separately.

Editorial sources (8)

• Azure built-in roles for Networking →

  Supports: Description, Practical scope, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• What is Azure role-based access control (Azure RBAC)? →

  Supports: Practical scope. Retrieved 2026-07-16.

• How Azure Traffic Manager works →

  Supports: Description, Common use cases, Best practices, Security considerations. Retrieved 2026-07-16.

• Manage Azure Traffic Manager profiles →

  Supports: Common use cases. Retrieved 2026-07-16.

• Azure Traffic Manager endpoint monitoring →

  Supports: Description, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

Official Microsoft Learn documentation →