What is the min IAM role required to create Azure Policy and Blueprint

Pallab Chakraborty 401 Reputation points

I have contributor access to a subscription. But i am not able to create Azure Policy and assign it to a particular resource group under the subscription. What is the role i needed to be assigned to if i need to create an Azure Policy and apply it to a subscription or a management group level.


Azure Policy
Azure Policy
An Azure service that is used to implement corporate governance and standards at scale for Azure resources.
817 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,220 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. AmanpreetSingh-MSFT 56,471 Reputation points

    @Anonymous Below are the roles which are available by default for Azure Policy and Blueprint:

    1. Resource Policy Contributor: Can perform most Azure Policy operations.
    2. Blueprint Contributor: Can manage blueprint definitions, but not assign them.
    3. Blueprint Operator: Can assign existing published blueprints, but can't create new blueprint definitions. Blueprint assignment only works if the assignment is done with a user-assigned managed identity.

    However, if you think that these roles have more permissions than what you need, you can create a custom role as explained here: https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles

    The permissions that you would need to add under "Actions" section of the custom role are provided in below links:

    You can add desired permissions that you want to assign to the users via custom role. You can also create a single role for both Azure Policy as well as for Blueprint.


    Please "Accept as answer" wherever the information provided helps you to help others in the community.

    4 people found this answer helpful.
    0 comments No comments