Built-In Roles and Custom Roles

Azure provides more than 300 built-in RBAC roles that cover common access patterns. When none of these roles fit your requirements exactly, you can create custom roles with precisely the permissions you need.

---

The Three Fundamental Built-In Roles

Three roles appear at every scope in Azure and are the most widely used:

Role	Description
Owner	Full access to all resources, including the ability to assign roles to others
Contributor	Full access to all resources, but cannot manage role assignments or manage Blueprints
Reader	View all resources but cannot make any changes

When to Use Each

• Owner — only for subscription or management group administrators who need to delegate access
• Contributor — for users who need to create and manage resources but should not control access
• Reader — for auditors, stakeholders, or dashboards that need visibility without modification rights

---

Commonly Used Built-In Roles

Beyond the three fundamental roles, Azure provides service-specific roles:

Identity and Access

Role	Description
User Access Administrator	Manage user access to Azure resources (role assignments)
Role Based Access Control Administrator	Manage RBAC role assignments only (no resource access)

Compute

Role	Description
Virtual Machine Contributor	Create and manage VMs, but not the VNet or storage they connect to
Virtual Machine Administrator Login	View VMs and log in as administrator
Virtual Machine User Login	View VMs and log in as a regular user

Storage

Role	Description
Storage Account Contributor	Manage storage accounts (create, delete, update)
Storage Blob Data Contributor	Read, write, and delete blob containers and data
Storage Blob Data Reader	Read blob containers and data only

Networking

Role	Description
Network Contributor	Manage all networking resources
DNS Zone Contributor	Manage DNS zones and records

Databases

Role	Description
SQL DB Contributor	Manage SQL databases but not their security policies
Cosmos DB Account Reader Role	Read Cosmos DB account data

Monitoring

Role	Description
Monitoring Contributor	Read monitoring data and edit monitoring settings
Monitoring Reader	Read all monitoring data
Log Analytics Contributor	Read and configure Log Analytics

---

Viewing Built-In Roles

In the Azure Portal