Azure Web and Mobile built-in role

Web Plan Contributor

Manages App Service plan resources through Microsoft.Web/serverFarms/* control-plane Actions. That wildcard includes startSites, stopSites, and restartSites, which start, stop, or restart every app in the plan. These are plan-level lifecycle operations that affect hosted apps; the role does not include Microsoft.Web/sites/* and therefore does not directly manage each site's configuration, content, or deployment. The definition also contains Actions for autoscale settings, joining an App Service Environment, deployments, classic alerts, and support tickets when those target resources are within scope, but it cannot create Azure role assignments.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: 2cc479cb-7b4d-49a8-b449-8c00fd0f0a4b

Control-plane actions (9)

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

Assign on one existing App Service plan only when the principal manages its capacity and is authorized to start, stop, or restart every app in that plan. Plan scope does not grant Microsoft.Web/sites/* for direct site configuration, and it does not cover separately scoped autoscale settings, an App Service Environment, deployments, or classic alert rules. Use a resource group or another reviewed common parent only when the workflow requires those sibling resources or creation of multiple plans. Support requests require subscription-level access.

Common use cases (2)

Prerequisites (3)

Best practices (3)

Security considerations (5)

Assignment guidance

Assign Web Plan Contributor to the platform operator on the individual App Service plan only when that operator is authorized for capacity changes and start, stop, or restart of every hosted app. Use a dedicated resource group or another reviewed common parent only when plan creation or sibling autoscale or App Service Environment operations are required. Grant Website Contributor separately for direct site configuration and deployment, Support Request Contributor separately at subscription scope for support duties, and an access-administration role separately for role assignments.

Related roles (1)

Common questions

When should I assign the Web Plan Contributor Azure role?

Assign Web Plan Contributor when you need to: Let a platform operator manage one existing App Service plan, including coordinated start, stop, or restart of all apps in that plan, without granting direct site-configuration or deployment authority.; and Create and manage multiple plans in a dedicated resource group, with a separately reviewed common-parent assignment when the workflow also targets an autoscale setting or App Service Environment.. Practical scope: Assign on one existing App Service plan only when the principal manages its capacity and is authorized to start, stop, or restart every app in that plan. Plan scope does not grant Microsoft.Web/sites/* for direct site configuration, and it does not cover separately scoped autoscale settings, an App Service Environment, deployments, or classic alert rules. Use a resource group or another reviewed common parent only when the workflow requires those sibling resources or creation of multiple plans. Support requests require subscription-level access.

What permissions does the Web Plan Contributor Azure role grant?

The role definition grants 9 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; Microsoft.ResourceHealth/availabilityStatuses/read; Microsoft.Resources/deployments/*; Microsoft.Resources/subscriptions/resourceGroups/read; and Microsoft.Support/*. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Web Plan Contributor Azure role?

Key considerations when assigning Web Plan Contributor: The role can reconfigure or delete App Service plans and can start, stop, or restart every app in a plan, affecting availability, capacity, performance, and cost for all apps that share it.; The absence of Microsoft.Web/sites/* prevents direct site-configuration, content, and deployment operations, but it does not make the role operationally harmless to the hosted apps because the serverFarms lifecycle Actions apply to all of them.; A plan-resource assignment cannot exercise the role definition's Actions against sibling autoscale settings or App Service Environments; a broader common-parent assignment can and also covers other matching resources in that scope.; and Subscription scope is required for support-ticket authority and would extend all of this role's plan-management permissions across the subscription.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (10)

Official Microsoft Learn documentation →