Azure role-based access control (Azure RBAC) has several Azure built-in roles that you can assign to users, groups, service principals, and managed identities. Role assignments are the way you control access to Azure resources. If the built-in roles don't meet the specific needs of your organization, you can create your own Azure custom roles.

Understanding the Context

Starting in December 2025, Azure automatically assigned the Owner role at subscription scope to users in the public cloud who were still assigned the Co-Administrator or Service Administrator role. As of May 2026, classic administrator roles are fully retired and you must assign roles in Azure role-based access control (RBAC) to manage access. Fixed database roles are defined at the database-level and exist in each database. Members of the db_owner database role can manage fixed database role membership.

Key Insights

There are also some special-purpose database roles in the msdb database. You can add any database account and other SQL Server roles into database-level roles. Learn how to grant access to Azure resources for users, groups, service principals, or managed identities using the Azure portal and Azure role-based access control (Azure RBAC). This article lists the Azure built-in roles for Azure role-based access control (Azure RBAC) in the Management and governance category. It lists Actions, NotActions, DataActions, and NotDataActions.

Final Thoughts

Learn about administrator roles, such as the global administrator role, or the service administrator role. Roles map to specific business functions and give permissions to do specific tasks in the Microsoft 365 admin center. This article lists the Azure built-in roles for Azure role-based access control (Azure RBAC) in the Web and Mobile category. It lists Actions, NotActions, DataActions, and NotDataActions.