Problem
Currently we are grant the managed-identities the contributor access on batch account.
This access is very open ended and could be a security issue.

Proposed Solution
Lets make use of custom-roles to create a custom role with selective permissions on batch account and assign the custom-role to managed-identities as required.