Azure RBAC Matrix
Look up what a built-in Azure role actually grants access to, runs entirely in your browser.
Owner
Full access to all resources, including the right to delegate access to others.
Contributor
Full access to manage resources, but cannot grant access to others.
Reader
View all resources, but cannot make changes.
User Access Administrator
Manage user access to Azure resources, without access to the resources themselves.
Virtual Machine Contributor
Create and manage virtual machines; does not grant access to the virtual network or storage account they connect to.
Storage Blob Data Contributor
Read, write, and delete Azure Storage blob containers and data.
Network Contributor
Create and manage virtual networks, subnets, and other networking resources.
Security Admin
View and update permissions for Microsoft Defender for Cloud, view security policies and alerts.
Backup Contributor
Manage backup services, except the removal of backups, creation of vaults, and giving access to others.
About this tool
A searchable reference for Azure’s most commonly used built-in roles (Owner, Contributor, Reader, User Access Administrator, and several service-specific roles), what each one actually grants: managing access, creating or deleting resources, read-only visibility, or a narrower capability like managing storage, networking, or backups.
Filter by role name or by capability (try "storage" or "networking") to answer the question that actually comes up during access reviews: which of our roles can do X, not just what X role is named.
Frequently asked questions
- Is this the complete list of every Azure built-in role?
- No, Azure ships well over 100 built-in roles. This is a curated reference of the roles developers and platform engineers reach for most often, not a live mirror of the full Azure role catalog.
- What is the difference between Owner and Contributor?
- Both can create, modify, and delete resources, but only Owner can also grant or revoke other users’ access (manage role assignments) and manage cost/billing on the scope. Contributor deliberately cannot touch access control at all.
- Why does Virtual Machine Contributor need a separate networking/storage role too?
- It is scoped narrowly on purpose: creating a VM that attaches to an existing virtual network or storage account needs a role with visibility into those resources too, since Virtual Machine Contributor alone does not grant access to networking or storage resources it doesn’t own.
- Does this reflect live data from my Azure subscription?
- No. This is a static, curated reference; it does not call the Azure API or read your subscription’s actual role assignments.
Continue learning
- DocumentationInfrastructure as Code SecurityHow plan-stage policy blocks unsafe AWS and Azure infrastructure before deployment, with practical policy testing and enforcement guidance.
- BlogTerraform Troubleshooting Guide: Fix the Errors Engineers Actually HitDiagnose Terraform initialization, validation, provider, authentication, state, drift, import, replacement, timeout, and CI failures with a safe workflow.
- ToolAzure Naming Convention GeneratorBuild a Cloud Adoption Framework-style Azure resource name from resource type, workload, environment, region, and instance, runs entirely in your browser.
- DocumentationKubernetes SecurityHow RBAC's additive model, Pod Security Standards, and NetworkPolicy fit together, and why each surprises people used to simpler permissions.
- BlogTerraform Azure VMSS: Load Balancer, Key Vault, and MonitorProvision an Azure VM Scale Set with Terraform behind a Standard Load Balancer, then add managed identity, Key Vault RBAC, monitoring, and verification.
- ToolAzure Resource ID ParserBreak an Azure Resource Manager ID into subscription, resource group, provider, and resource type/name, runs entirely in your browser.