Azure Web and Mobile built-in role

Website Contributor

Manages App Service websites and child resources through Microsoft.Web/sites/* control-plane Actions. That wildcard includes site and slot start, stop, and restart; publishing-profile access; listing security-sensitive configuration such as publishing credentials, app settings, and connection strings; and listing or changing Functions keys, host keys, and the host master key. The definition also contains Actions for certificates, Application Insights components, classic alerts, deployments, and support tickets, but an app-resource assignment does not reach separately scoped sibling resources and support requests require subscription-level access. It can read and join a plan where scope permits, has no DataActions, and cannot create Azure role assignments.

Control-plane actions (13)

• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Insights/components/*
• Microsoft.ResourceHealth/availabilityStatuses/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Support/*
• Microsoft.Web/certificates/*
• Microsoft.Web/listSitesAssignedToHostName/read
• Microsoft.Web/register/action
• Microsoft.Web/serverFarms/join/action
• Microsoft.Web/serverFarms/read
• Microsoft.Web/sites/*

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign directly on an existing App Service app for one deployment identity or operator. That assignment covers the app and its children, not sibling App Service certificates, Application Insights components, classic alert rules, or resource-group deployments. Use a resource group only when the workflow must manage those sibling resources or multiple apps. Support requests require subscription-level access.

Common use cases (2)

• Deploy and manage one Azure App Service web app or deployment slots without granting management of the underlying App Service plan.
• Use a Microsoft Entra application or user-assigned managed identity with OpenID Connect for a GitHub Actions deployment scoped to one app and, when used, its deployment slot.

Prerequisites (4)

• The App Service app and its plan must already exist, the assignee must be approved to access the app's sensitive configuration and Functions credentials, and any required certificate, Application Insights component, alert rule, or resource-group deployment must be provisioned or authorized at a scope that contains that sibling resource.
• For GitHub Actions with OpenID Connect, configure a Microsoft Entra application or user-assigned managed identity with a federated credential and assign Website Contributor on the app and on a deployment slot when that slot is targeted.
• If the workflow uses local Git, FTP/S, or a publish profile, basic authentication must be explicitly enabled; Microsoft documents it as less secure and disables it by default for new apps.
• Plan-level scale and pricing operations require separate write access to the App Service plan.

Best practices (3)

• Assign directly on the app only to an identity trusted with its sensitive configuration and Functions credentials, and use OpenID Connect with a federated workload identity for GitHub Actions instead of storing a client secret or publish profile.
• Keep SCM and FTP basic authentication disabled unless a reviewed deployment method requires it, and reset app-scope credentials after suspected exposure.
• Separate website administration from Web Plan Contributor, Support Request Contributor, and Azure RBAC delegation duties.

Security considerations (4)

• Website write access enables app and slot start, stop, and restart; configuration changes; log streaming; console and deployment access; publishing-profile retrieval; and access to app settings, connection strings, publishing credentials, Functions keys, host keys, and the Functions host master key.
• At app scope, the role can modify or delete the app and its slots but cannot exercise certificate, Application Insights, classic-alert, or resource-group deployment Actions against sibling resources. A resource-group assignment can make those Actions effective and covers every matching resource in that group.
• Subscription scope is required for support-ticket authority and would extend all Website Contributor permissions across the subscription.
• It cannot manage the App Service plan or create Azure role assignments; those duties require separate access.

Assignment guidance

Assign Website Contributor to the deployment identity or application operator directly on the App Service app only when that principal is trusted with site lifecycle, sensitive configuration, publishing credentials, and Functions keys; assign it on a targeted deployment slot when required. Broaden to a dedicated resource group only for reviewed sibling-resource operations. Prefer GitHub Actions OpenID Connect, grant Web Plan Contributor separately to the capacity operator, Support Request Contributor separately at subscription scope for support duties, and an access-administration role separately for role assignments.

Related roles (1)

• Web Plan Contributor: Manages App Service plans but not the websites hosted on them; some portal workflows require distinct access to both resources.

Editorial sources (11)

• Azure built-in roles for Web and Mobile - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Prerequisites, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Troubleshoot Azure RBAC - Azure features are disabled →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Manage deployment credentials for Azure App Service →

  Supports: Description, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Secure your Azure App Service deployment →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Azure permissions for Web and Mobile - Microsoft.Web →

  Supports: Description, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Deploy to Azure App Service by using GitHub Actions →

  Supports: Common use cases, Prerequisites, Best practices, Assignment guidance. Retrieved 2026-07-17.

• Create an Azure support request →

  Supports: Description, Practical scope, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

Official Microsoft Learn documentation →