Azure role-based access control (Azure RBAC) has several Azure built-in roles that you can assign to users, groups, service principals, and managed identities. Role assignments are the way you control access to Azure resources. If the built-in roles don't meet the specific needs of your organization, you can create your own Azure custom roles.

Understanding the Context

This article lists the Azure built-in roles for Azure role-based access control (Azure RBAC) in the Web and Mobile category. It lists Actions, NotActions, DataActions, and NotDataActions. This article lists the Azure built-in roles for Azure role-based access control (Azure RBAC) in the Management and governance category. It lists Actions, NotActions, DataActions, and NotDataActions.

Key Insights

Get an overview of Azure role-based access control (Azure RBAC). Use role assignments to control access to Azure resources. This article lists the Azure built-in roles for Azure role-based access control (Azure RBAC) in the Security category. It lists Actions, NotActions, DataActions, and NotDataActions. Learn how to grant access to Azure resources for users, groups, service principals, or managed identities using the Azure portal and Azure role-based access control (Azure RBAC).

Final Thoughts

In Microsoft Entra ID, if another administrator or nonadministrator needs to manage Microsoft Entra resources, you assign them a Microsoft Entra role that provides the permissions they need. For example, you can assign roles to allow adding or changing users, resetting user passwords, managing user licenses, or managing domain names. This article lists the Microsoft Entra built-in roles you ... Learn about Azure role definitions in Azure role-based access control (Azure RBAC) for fine-grained access management of Azure resources. Starting in December 2025, Azure automatically assigned the Owner role at subscription scope to users in the public cloud who were still assigned the Co-Administrator or Service Administrator role. As of May 2026, classic administrator roles are fully retired and you must assign roles in Azure role-based access control (RBAC) to manage access.