Azure Web and Mobile built-in role

Web Plan Contributor

Manages App Service plan resources through Microsoft.Web/serverFarms/* control-plane Actions. That wildcard includes startSites, stopSites, and restartSites, which start, stop, or restart every app in the plan. These are plan-level lifecycle operations that affect hosted apps; the role does not include Microsoft.Web/sites/* and therefore does not directly manage each site's configuration, content, or deployment. The definition also contains Actions for autoscale settings, joining an App Service Environment, deployments, classic alerts, and support tickets when those target resources are within scope, but it cannot create Azure role assignments.

Control-plane actions (9)

• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.ResourceHealth/availabilityStatuses/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Support/*
• Microsoft.Web/serverFarms/*
• Microsoft.Web/hostingEnvironments/Join/Action
• Microsoft.Insights/autoscalesettings/*

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on one existing App Service plan only when the principal manages its capacity and is authorized to start, stop, or restart every app in that plan. Plan scope does not grant Microsoft.Web/sites/* for direct site configuration, and it does not cover separately scoped autoscale settings, an App Service Environment, deployments, or classic alert rules. Use a resource group or another reviewed common parent only when the workflow requires those sibling resources or creation of multiple plans. Support requests require subscription-level access.

Common use cases (2)

• Let a platform operator manage one existing App Service plan, including coordinated start, stop, or restart of all apps in that plan, without granting direct site-configuration or deployment authority.
• Create and manage multiple plans in a dedicated resource group, with a separately reviewed common-parent assignment when the workflow also targets an autoscale setting or App Service Environment.

Prerequisites (3)

• Identify the App Service plan or dedicated resource group, inventory every app sharing the plan, and confirm that the principal owns plan capacity and plan-wide lifecycle operations rather than direct application configuration.
• Inventory any autoscale setting, App Service Environment, deployment, or classic alert rule the workflow must change and choose a scope that actually contains those resources; a plan-resource assignment is insufficient for sibling resources.
• Plan a separate Website Contributor or other app-scoped assignment for principals that must manage the hosted sites; web-app access alone does not provide all plan-level capabilities.

Best practices (3)

• Assign directly on an existing plan when resource creation is unnecessary and keep plan capacity and plan-wide lifecycle administration separate from direct website configuration and deployment duties.
• Use managed identities for application access to downstream Azure services and apply minimum necessary RBAC permissions for management operations.
• Use Support Request Contributor at subscription scope for support-ticket duties instead of assigning Web Plan Contributor across the subscription.

Security considerations (5)

• The role can reconfigure or delete App Service plans and can start, stop, or restart every app in a plan, affecting availability, capacity, performance, and cost for all apps that share it.
• The absence of Microsoft.Web/sites/* prevents direct site-configuration, content, and deployment operations, but it does not make the role operationally harmless to the hosted apps because the serverFarms lifecycle Actions apply to all of them.
• A plan-resource assignment cannot exercise the role definition's Actions against sibling autoscale settings or App Service Environments; a broader common-parent assignment can and also covers other matching resources in that scope.
• Subscription scope is required for support-ticket authority and would extend all of this role's plan-management permissions across the subscription.
• The role reads authorization metadata but has no role-assignment write Action, so access delegation requires a separate privileged role.

Assignment guidance

Assign Web Plan Contributor to the platform operator on the individual App Service plan only when that operator is authorized for capacity changes and start, stop, or restart of every hosted app. Use a dedicated resource group or another reviewed common parent only when plan creation or sibling autoscale or App Service Environment operations are required. Grant Website Contributor separately for direct site configuration and deployment, Support Request Contributor separately at subscription scope for support duties, and an access-administration role separately for role assignments.

Related roles (1)

• Website Contributor: Manages App Service websites but not their App Service plans; some portal workflows require distinct access to both resources.

Editorial sources (10)

• Azure built-in roles for Web and Mobile - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Troubleshoot Azure RBAC - Azure features are disabled →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Secure your Azure App Service deployment →

  Supports: Best practices. Retrieved 2026-07-17.

• Azure App Service Plans - Azure App Service →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Azure permissions for Web and Mobile - Microsoft.Web →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Create an Azure support request →

  Supports: Description, Practical scope, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

Official Microsoft Learn documentation →