User with Website Contributor role is able to add tags

Hi Marek,

The “Website Contributor” role in Azure is a built-in role that has specific permissions. While it’s true that the explicit permission Microsoft.Resources/tags/write is not listed under this role, it’s important to note that the ability to add tags to resources in Azure is not solely governed by this permission.

In Azure, the ability to apply tags to resources can be granted in two ways:

1. Having write access to the Microsoft.Resources/tags resource type. This access lets you tag any resource, even if you don’t have access to the resource itself. The “Tag Contributor” role grants this access.
2. Having write access to the resource itself. The “Contributor” role grants the required access to apply tags to any entity.

The “Website Contributor” role falls under the second category. It allows the user to manage websites (not web plans), thereby granting write access to the website resource itself. This means that even though the Microsoft.Resources/tags/write permission is not explicitly listed, users with the “Website Contributor” role can still apply tags to the website resources they manage.

This might help explain the behaviour you’re observing.

Please see the links below for reference:

https://video2.skills-academy.com/en-us/azure/azure-resource-manager/management/tag-resources#required-access

https://video2.skills-academy.com/en-us/azure/role-based-access-control/built-in-roles

If you find this response helpful and it resolves your issue, please consider marking it as “Accepted” or giving it an upvote. This will help others in the community find the solution more easily.