A built-in role is a predefined Azure RBAC role containing the permissions required for a specific task. It avoids creating common permission sets from scratch while supporting least privilege. section 2.3.2
Four fundamental Azure RBAC built-in roles are:
- Owner: provides full access to resources and can delegate access. section 2.3.2
- Contributor: manages all resource types but cannot delegate access. section 2.3.2
- Reader: views existing resources. section 2.3.2
- User access administrator: manages access to Azure resources. section 2.3.2
Role definitions can be granular or broad. Their properties describe permissions, assignable scopes, identifiers, and descriptions, helping you verify what access a role grants. section 2.3.2
Virtual Machine Contributor
Assign Virtual Machine Contributor when someone needs to manage virtual machines. The role limits access to the virtual-machine task and resource type, excluding connected storage accounts and virtual networks; its description also states that it does not provide access to the machines themselves. section 2.3.2
az role definition list --name "Virtual Machine Contributor"
Inspect a built-in role definition in Azure Cloud Shell with az role definition list --name "Virtual Machine Contributor". section 2.3.2
