Azure built-in roles for Web and Mobile

Raksts
09/23/2024

This article lists the Azure built-in roles in the Web and Mobile category.

Azure Maps Data Contributor

Grants access to read, write, and delete access to map related data from an Azure maps account.

Actions	Description
none
NotActions
none
DataActions
Microsoft.Maps/accounts/*/read
Microsoft.Maps/accounts/*/write
Microsoft.Maps/accounts/*/delete
Microsoft.Maps/accounts/*/action
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants access to read, write, and delete access to map related data from an Azure maps account.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/8f5e0ce6-4f7b-4dcf-bddf-e6f48634a204",
  "name": "8f5e0ce6-4f7b-4dcf-bddf-e6f48634a204",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.Maps/accounts/*/read",
        "Microsoft.Maps/accounts/*/write",
        "Microsoft.Maps/accounts/*/delete",
        "Microsoft.Maps/accounts/*/action"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Maps Data Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Maps Data Reader

Grants access to read map related data from an Azure maps account.

Learn more

Actions	Description
none
NotActions
none
DataActions
Microsoft.Maps/accounts/*/read
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants access to read map related data from an Azure maps account.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/423170ca-a8f6-4b0f-8487-9e4eb8f49bfa",
  "name": "423170ca-a8f6-4b0f-8487-9e4eb8f49bfa",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.Maps/accounts/*/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Maps Data Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Maps Search and Render Data Reader

Grants access to very limited set of data APIs for common visual web SDK scenarios. Specifically, render and search data APIs.

Learn more

Actions	Description
none
NotActions
none
DataActions
Microsoft.Maps/accounts/services/render/read	Allows reading of data for Render services.
Microsoft.Maps/accounts/services/search/read	Allows reading of data for Search services.
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants access to very limited set of data APIs for common visual web SDK scenarios. Specifically, render and search data APIs.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/6be48352-4f82-47c9-ad5e-0acacefdb005",
  "name": "6be48352-4f82-47c9-ad5e-0acacefdb005",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.Maps/accounts/services/render/read",
        "Microsoft.Maps/accounts/services/search/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Maps Search and Render Data Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Spring Apps Application Configuration Service Config File Pattern Reader Role

Read content of config file pattern for Application Configuration Service in Azure Spring Apps

Learn more

Actions	Description
Microsoft.AppPlatform/Spring/read	Get Azure Spring Apps service instance(s)
Microsoft.AppPlatform/Spring/configurationServices/read	Get the Application Configuration Services for a specific Azure Spring Apps service instance
NotActions
none
DataActions
Microsoft.AppPlatform/Spring/ApplicationConfigurationService/read	Read the configuration content (for example, application-prod.yaml) pulled by Application Configuration Service for a specific Azure Spring Apps service instance
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Read content of config file pattern for Application Configuration Service in Azure Spring Apps",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/25211fc6-dc78-40b6-b205-e4ac934fd9fd",
  "name": "25211fc6-dc78-40b6-b205-e4ac934fd9fd",
  "permissions": [
    {
      "actions": [
        "Microsoft.AppPlatform/Spring/read",
        "Microsoft.AppPlatform/Spring/configurationServices/read"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.AppPlatform/Spring/ApplicationConfigurationService/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Spring Apps Application Configuration Service Config File Pattern Reader Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Spring Apps Application Configuration Service Log Reader Role

Read real-time logs for Application Configuration Service in Azure Spring Apps

Learn more

Actions	Description
Microsoft.AppPlatform/Spring/read	Get Azure Spring Apps service instance(s)
Microsoft.AppPlatform/Spring/configurationServices/read	Get the Application Configuration Services for a specific Azure Spring Apps service instance
NotActions
none
DataActions
Microsoft.AppPlatform/Spring/ApplicationConfigurationService/logstream/action	Read the streaming log of all subcomponents in Application Configuration Service from a specific Azure Spring Apps service instance
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Read real-time logs for Application Configuration Service in Azure Spring Apps",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/6593e776-2a30-40f9-8a32-4fe28b77655d",
  "name": "6593e776-2a30-40f9-8a32-4fe28b77655d",
  "permissions": [
    {
      "actions": [
        "Microsoft.AppPlatform/Spring/read",
        "Microsoft.AppPlatform/Spring/configurationServices/read"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.AppPlatform/Spring/ApplicationConfigurationService/logstream/action"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Spring Apps Application Configuration Service Log Reader Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Spring Apps Connect Role

Learn more

Actions	Description
none
NotActions
none
DataActions
Microsoft.AppPlatform/Spring/apps/deployments/connect/action	Connect to an instance for a specific application
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Azure Spring Apps Connect Role",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/80558df3-64f9-4c0f-b32d-e5094b036b0b",
  "name": "80558df3-64f9-4c0f-b32d-e5094b036b0b",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.AppPlatform/Spring/apps/deployments/connect/action"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Spring Apps Connect Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Spring Apps Job Log Reader Role

Read real-time logs for jobs in Azure Spring Apps

Learn more

Actions	Description
Microsoft.AppPlatform/Spring/read	Get Azure Spring Apps service instance(s)
Microsoft.AppPlatform/Spring/jobs/read	Get the job for a specific Azure Spring Apps service instance
Microsoft.AppPlatform/Spring/jobs/executions/read	Get the job execution for a specific Azure Spring Apps service instance
NotActions
none
DataActions
Microsoft.AppPlatform/Spring/jobs/executions/logstream/action	Get the streaming log of job executions for a specific Azure Spring Apps service instance
Microsoft.AppPlatform/Spring/jobs/executions/listInstances/action	List instances of a specific job execution for a specific Azure Spring Apps service instance
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Read real-time logs for jobs in Azure Spring Apps",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/b459aa1d-e3c8-436f-ae21-c0531140f43e",
  "name": "b459aa1d-e3c8-436f-ae21-c0531140f43e",
  "permissions": [
    {
      "actions": [
        "Microsoft.AppPlatform/Spring/read",
        "Microsoft.AppPlatform/Spring/jobs/read",
        "Microsoft.AppPlatform/Spring/jobs/executions/read"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.AppPlatform/Spring/jobs/executions/logstream/action",
        "Microsoft.AppPlatform/Spring/jobs/executions/listInstances/action"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Spring Apps Job Log Reader Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Spring Apps Remote Debugging Role

Learn more

Actions	Description
none
NotActions
none
DataActions
Microsoft.AppPlatform/Spring/apps/deployments/remotedebugging/action	Remote debugging app instance for a specific application
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Azure Spring Apps Remote Debugging Role",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/a99b0159-1064-4c22-a57b-c9b3caa1c054",
  "name": "a99b0159-1064-4c22-a57b-c9b3caa1c054",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.AppPlatform/Spring/apps/deployments/remotedebugging/action"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Spring Apps Remote Debugging Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Spring Apps Spring Cloud Gateway Log Reader Role

Read real-time logs for Spring Cloud Gateway in Azure Spring Apps

Learn more

Actions	Description
Microsoft.AppPlatform/Spring/read	Get Azure Spring Apps service instance(s)
Microsoft.AppPlatform/Spring/gateways/read	Get the Spring Cloud Gateways for a specific Azure Spring Apps service instance
NotActions
none
DataActions
Microsoft.AppPlatform/Spring/SpringCloudGateway/logstream/action	Read the streaming log of Spring Cloud Gateway from a specific Azure Spring Apps service instance
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Read real-time logs for Spring Cloud Gateway in Azure Spring Apps",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/4301dc2a-25a9-44b0-ae63-3636cf7f2bd2",
  "name": "4301dc2a-25a9-44b0-ae63-3636cf7f2bd2",
  "permissions": [
    {
      "actions": [
        "Microsoft.AppPlatform/Spring/read",
        "Microsoft.AppPlatform/Spring/gateways/read"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.AppPlatform/Spring/SpringCloudGateway/logstream/action"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Spring Apps Spring Cloud Gateway Log Reader Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Spring Cloud Config Server Contributor

Allow read, write and delete access to Azure Spring Cloud Config Server

Learn more

Actions	Description
none
NotActions
none
DataActions
Microsoft.AppPlatform/Spring/configService/read	Read the configuration content(for example, application.yaml) for a specific Azure Spring Apps service instance
Microsoft.AppPlatform/Spring/configService/write	Write config server content for a specific Azure Spring Apps service instance
Microsoft.AppPlatform/Spring/configService/delete	Delete config server content for a specific Azure Spring Apps service instance
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Allow read, write and delete access to Azure Spring Cloud Config Server",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/a06f5c24-21a7-4e1a-aa2b-f19eb6684f5b",
  "name": "a06f5c24-21a7-4e1a-aa2b-f19eb6684f5b",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.AppPlatform/Spring/configService/read",
        "Microsoft.AppPlatform/Spring/configService/write",
        "Microsoft.AppPlatform/Spring/configService/delete"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Spring Cloud Config Server Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Spring Cloud Config Server Reader

Allow read access to Azure Spring Cloud Config Server

Learn more

Actions	Description
none
NotActions
none
DataActions
Microsoft.AppPlatform/Spring/configService/read	Read the configuration content(for example, application.yaml) for a specific Azure Spring Apps service instance
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Allow read access to Azure Spring Cloud Config Server",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/d04c6db6-4947-4782-9e91-30a88feb7be7",
  "name": "d04c6db6-4947-4782-9e91-30a88feb7be7",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.AppPlatform/Spring/configService/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Spring Cloud Config Server Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Spring Cloud Data Reader

Allow read access to Azure Spring Cloud Data

Actions	Description
none
NotActions
none
DataActions
Microsoft.AppPlatform/Spring/*/read
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Allow read access to Azure Spring Cloud Data",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/b5537268-8956-4941-a8f0-646150406f0c",
  "name": "b5537268-8956-4941-a8f0-646150406f0c",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.AppPlatform/Spring/*/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Spring Cloud Data Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Spring Cloud Service Registry Contributor

Allow read, write and delete access to Azure Spring Cloud Service Registry

Learn more

Actions	Description
none
NotActions
none
DataActions
Microsoft.AppPlatform/Spring/eurekaService/read	Read the user app(s) registration information for a specific Azure Spring Apps service instance
Microsoft.AppPlatform/Spring/eurekaService/write	Write the user app(s) registration information for a specific Azure Spring Apps service instance
Microsoft.AppPlatform/Spring/eurekaService/delete	Delete the user app registration information for a specific Azure Spring Apps service instance
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Allow read, write and delete access to Azure Spring Cloud Service Registry",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/f5880b48-c26d-48be-b172-7927bfa1c8f1",
  "name": "f5880b48-c26d-48be-b172-7927bfa1c8f1",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.AppPlatform/Spring/eurekaService/read",
        "Microsoft.AppPlatform/Spring/eurekaService/write",
        "Microsoft.AppPlatform/Spring/eurekaService/delete"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Spring Cloud Service Registry Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Spring Cloud Service Registry Reader

Allow read access to Azure Spring Cloud Service Registry

Learn more

Actions	Description
none
NotActions
none
DataActions
Microsoft.AppPlatform/Spring/eurekaService/read	Read the user app(s) registration information for a specific Azure Spring Apps service instance
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Allow read access to Azure Spring Cloud Service Registry",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/cff1b556-2399-4e7e-856d-a8f754be7b65",
  "name": "cff1b556-2399-4e7e-856d-a8f754be7b65",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.AppPlatform/Spring/eurekaService/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Spring Cloud Service Registry Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Media Services Account Administrator

Create, read, modify, and delete Media Services accounts; read-only access to other Media Services resources.

Actions	Description
Microsoft.Authorization/*/read	Read roles and role assignments
Microsoft.Insights/alertRules/*	Create and manage a classic metric alert
Microsoft.Insights/metrics/read	Read metrics
Microsoft.Insights/metricDefinitions/read	Read metric definitions
Microsoft.Resources/deployments/*	Create and manage a deployment
Microsoft.Resources/subscriptions/resourceGroups/read	Gets or lists resource groups.
Microsoft.ResourceHealth/availabilityStatuses/read	Gets the availability statuses for all resources in the specified scope
Microsoft.Media/mediaservices/*/read
Microsoft.Media/mediaservices/assets/listStreamingLocators/action	List Streaming Locators for Asset
Microsoft.Media/mediaservices/streamingLocators/listPaths/action	List Paths
Microsoft.Media/mediaservices/write	Create or Update any Media Services Account
Microsoft.Media/mediaservices/delete	Delete any Media Services Account
Microsoft.Media/mediaservices/privateEndpointConnectionsApproval/action	Approve Private Endpoint Connections
Microsoft.Media/mediaservices/privateEndpointConnections/*
NotActions
none
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Create, read, modify, and delete Media Services accounts; read-only access to other Media Services resources.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/054126f8-9a2b-4f1c-a9ad-eca461f08466",
  "name": "054126f8-9a2b-4f1c-a9ad-eca461f08466",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Insights/metrics/read",
        "Microsoft.Insights/metricDefinitions/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ResourceHealth/availabilityStatuses/read",
        "Microsoft.Media/mediaservices/*/read",
        "Microsoft.Media/mediaservices/assets/listStreamingLocators/action",
        "Microsoft.Media/mediaservices/streamingLocators/listPaths/action",
        "Microsoft.Media/mediaservices/write",
        "Microsoft.Media/mediaservices/delete",
        "Microsoft.Media/mediaservices/privateEndpointConnectionsApproval/action",
        "Microsoft.Media/mediaservices/privateEndpointConnections/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Media Services Account Administrator",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Media Services Live Events Administrator

Create, read, modify, and delete Live Events, Assets, Asset Filters, and Streaming Locators; read-only access to other Media Services resources.

Actions	Description
Microsoft.Authorization/*/read	Read roles and role assignments
Microsoft.Insights/alertRules/*	Create and manage a classic metric alert
Microsoft.Insights/metrics/read	Read metrics
Microsoft.Insights/metricDefinitions/read	Read metric definitions
Microsoft.Resources/deployments/*	Create and manage a deployment
Microsoft.Resources/subscriptions/resourceGroups/read	Gets or lists resource groups.
Microsoft.ResourceHealth/availabilityStatuses/read	Gets the availability statuses for all resources in the specified scope
Microsoft.Media/mediaservices/*/read
Microsoft.Media/mediaservices/assets/*
Microsoft.Media/mediaservices/assets/assetfilters/*
Microsoft.Media/mediaservices/streamingLocators/*
Microsoft.Media/mediaservices/liveEvents/*
NotActions
Microsoft.Media/mediaservices/assets/getEncryptionKey/action	Get Asset Encryption Key
Microsoft.Media/mediaservices/streamingLocators/listContentKeys/action	List Content Keys
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Create, read, modify, and delete Live Events, Assets, Asset Filters, and Streaming Locators; read-only access to other Media Services resources.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/532bc159-b25e-42c0-969e-a1d439f60d77",
  "name": "532bc159-b25e-42c0-969e-a1d439f60d77",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Insights/metrics/read",
        "Microsoft.Insights/metricDefinitions/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ResourceHealth/availabilityStatuses/read",
        "Microsoft.Media/mediaservices/*/read",
        "Microsoft.Media/mediaservices/assets/*",
        "Microsoft.Media/mediaservices/assets/assetfilters/*",
        "Microsoft.Media/mediaservices/streamingLocators/*",
        "Microsoft.Media/mediaservices/liveEvents/*"
      ],
      "notActions": [
        "Microsoft.Media/mediaservices/assets/getEncryptionKey/action",
        "Microsoft.Media/mediaservices/streamingLocators/listContentKeys/action"
      ],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Media Services Live Events Administrator",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Media Services Media Operator

Create, read, modify, and delete Assets, Asset Filters, Streaming Locators, and Jobs; read-only access to other Media Services resources.

Actions	Description
Microsoft.Authorization/*/read	Read roles and role assignments
Microsoft.Insights/alertRules/*	Create and manage a classic metric alert
Microsoft.Insights/metrics/read	Read metrics
Microsoft.Insights/metricDefinitions/read	Read metric definitions
Microsoft.Resources/deployments/*	Create and manage a deployment
Microsoft.Resources/subscriptions/resourceGroups/read	Gets or lists resource groups.
Microsoft.ResourceHealth/availabilityStatuses/read	Gets the availability statuses for all resources in the specified scope
Microsoft.Media/mediaservices/*/read
Microsoft.Media/mediaservices/assets/*
Microsoft.Media/mediaservices/assets/assetfilters/*
Microsoft.Media/mediaservices/streamingLocators/*
Microsoft.Media/mediaservices/transforms/jobs/*
NotActions
Microsoft.Media/mediaservices/assets/getEncryptionKey/action	Get Asset Encryption Key
Microsoft.Media/mediaservices/streamingLocators/listContentKeys/action	List Content Keys
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Create, read, modify, and delete Assets, Asset Filters, Streaming Locators, and Jobs; read-only access to other Media Services resources.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/e4395492-1534-4db2-bedf-88c14621589c",
  "name": "e4395492-1534-4db2-bedf-88c14621589c",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Insights/metrics/read",
        "Microsoft.Insights/metricDefinitions/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ResourceHealth/availabilityStatuses/read",
        "Microsoft.Media/mediaservices/*/read",
        "Microsoft.Media/mediaservices/assets/*",
        "Microsoft.Media/mediaservices/assets/assetfilters/*",
        "Microsoft.Media/mediaservices/streamingLocators/*",
        "Microsoft.Media/mediaservices/transforms/jobs/*"
      ],
      "notActions": [
        "Microsoft.Media/mediaservices/assets/getEncryptionKey/action",
        "Microsoft.Media/mediaservices/streamingLocators/listContentKeys/action"
      ],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Media Services Media Operator",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Media Services Policy Administrator

Create, read, modify, and delete Account Filters, Streaming Policies, Content Key Policies, and Transforms; read-only access to other Media Services resources. Cannot create Jobs, Assets or Streaming resources.

Actions	Description
Microsoft.Authorization/*/read	Read roles and role assignments
Microsoft.Insights/alertRules/*	Create and manage a classic metric alert
Microsoft.Insights/metrics/read	Read metrics
Microsoft.Insights/metricDefinitions/read	Read metric definitions
Microsoft.Resources/deployments/*	Create and manage a deployment
Microsoft.Resources/subscriptions/resourceGroups/read	Gets or lists resource groups.
Microsoft.ResourceHealth/availabilityStatuses/read	Gets the availability statuses for all resources in the specified scope
Microsoft.Media/mediaservices/*/read
Microsoft.Media/mediaservices/assets/listStreamingLocators/action	List Streaming Locators for Asset
Microsoft.Media/mediaservices/streamingLocators/listPaths/action	List Paths
Microsoft.Media/mediaservices/accountFilters/*
Microsoft.Media/mediaservices/streamingPolicies/*
Microsoft.Media/mediaservices/contentKeyPolicies/*
Microsoft.Media/mediaservices/transforms/*
NotActions
Microsoft.Media/mediaservices/contentKeyPolicies/getPolicyPropertiesWithSecrets/action	Get Policy Properties With Secrets
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Create, read, modify, and delete Account Filters, Streaming Policies, Content Key Policies, and Transforms; read-only access to other Media Services resources. Cannot create Jobs, Assets or Streaming resources.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/c4bba371-dacd-4a26-b320-7250bca963ae",
  "name": "c4bba371-dacd-4a26-b320-7250bca963ae",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Insights/metrics/read",
        "Microsoft.Insights/metricDefinitions/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ResourceHealth/availabilityStatuses/read",
        "Microsoft.Media/mediaservices/*/read",
        "Microsoft.Media/mediaservices/assets/listStreamingLocators/action",
        "Microsoft.Media/mediaservices/streamingLocators/listPaths/action",
        "Microsoft.Media/mediaservices/accountFilters/*",
        "Microsoft.Media/mediaservices/streamingPolicies/*",
        "Microsoft.Media/mediaservices/contentKeyPolicies/*",
        "Microsoft.Media/mediaservices/transforms/*"
      ],
      "notActions": [
        "Microsoft.Media/mediaservices/contentKeyPolicies/getPolicyPropertiesWithSecrets/action"
      ],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Media Services Policy Administrator",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Media Services Streaming Endpoints Administrator

Create, read, modify, and delete Streaming Endpoints; read-only access to other Media Services resources.

Actions	Description
Microsoft.Authorization/*/read	Read roles and role assignments
Microsoft.Insights/alertRules/*	Create and manage a classic metric alert
Microsoft.Insights/metrics/read	Read metrics
Microsoft.Insights/metricDefinitions/read	Read metric definitions
Microsoft.Resources/deployments/*	Create and manage a deployment
Microsoft.Resources/subscriptions/resourceGroups/read	Gets or lists resource groups.
Microsoft.ResourceHealth/availabilityStatuses/read	Gets the availability statuses for all resources in the specified scope
Microsoft.Media/mediaservices/*/read
Microsoft.Media/mediaservices/assets/listStreamingLocators/action	List Streaming Locators for Asset
Microsoft.Media/mediaservices/streamingLocators/listPaths/action	List Paths
Microsoft.Media/mediaservices/streamingEndpoints/*
NotActions
none
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Create, read, modify, and delete Streaming Endpoints; read-only access to other Media Services resources.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/99dba123-b5fe-44d5-874c-ced7199a5804",
  "name": "99dba123-b5fe-44d5-874c-ced7199a5804",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Insights/metrics/read",
        "Microsoft.Insights/metricDefinitions/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ResourceHealth/availabilityStatuses/read",
        "Microsoft.Media/mediaservices/*/read",
        "Microsoft.Media/mediaservices/assets/listStreamingLocators/action",
        "Microsoft.Media/mediaservices/streamingLocators/listPaths/action",
        "Microsoft.Media/mediaservices/streamingEndpoints/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Media Services Streaming Endpoints Administrator",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

SignalR AccessKey Reader

Read SignalR Service Access Keys

Actions	Description
Microsoft.SignalRService/*/read
Microsoft.SignalRService/SignalR/listkeys/action	View the value of SignalR access keys in the management portal or through API
Microsoft.Authorization/*/read	Read roles and role assignments
Microsoft.Resources/subscriptions/resourceGroups/read	Gets or lists resource groups.
Microsoft.Support/*	Create and update a support ticket
NotActions
none
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Read SignalR Service Access Keys",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/04165923-9d83-45d5-8227-78b77b0a687e",
  "name": "04165923-9d83-45d5-8227-78b77b0a687e",
  "permissions": [
    {
      "actions": [
        "Microsoft.SignalRService/*/read",
        "Microsoft.SignalRService/SignalR/listkeys/action",
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "SignalR AccessKey Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

SignalR App Server

Lets your app server access SignalR Service with AAD auth options.

Actions	Description
none
NotActions
none
DataActions
Microsoft.SignalRService/SignalR/auth/accessKey/action	Generate an AccessKey for signing AccessTokens, the key will expire in 90 minutes by default
Microsoft.SignalRService/SignalR/serverConnection/write	Start a server connection
Microsoft.SignalRService/SignalR/clientConnection/write	Close client connection
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets your app server access SignalR Service with AAD auth options.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/420fcaa2-552c-430f-98ca-3264be4806c7",
  "name": "420fcaa2-552c-430f-98ca-3264be4806c7",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.SignalRService/SignalR/auth/accessKey/action",
        "Microsoft.SignalRService/SignalR/serverConnection/write",
        "Microsoft.SignalRService/SignalR/clientConnection/write"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "SignalR App Server",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

SignalR REST API Owner

Full access to Azure SignalR Service REST APIs

Actions	Description
none
NotActions
none
DataActions
Microsoft.SignalRService/SignalR/auth/clientToken/action	Generate an AccessToken for client to connect to ASRS, the token will expire in 5 minutes by default
Microsoft.SignalRService/SignalR/hub/*
Microsoft.SignalRService/SignalR/group/*
Microsoft.SignalRService/SignalR/clientConnection/*
Microsoft.SignalRService/SignalR/user/*
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Full access to Azure SignalR Service REST APIs",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/fd53cd77-2268-407a-8f46-7e7863d0f521",
  "name": "fd53cd77-2268-407a-8f46-7e7863d0f521",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.SignalRService/SignalR/auth/clientToken/action",
        "Microsoft.SignalRService/SignalR/hub/*",
        "Microsoft.SignalRService/SignalR/group/*",
        "Microsoft.SignalRService/SignalR/clientConnection/*",
        "Microsoft.SignalRService/SignalR/user/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "SignalR REST API Owner",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

SignalR REST API Reader

Read-only access to Azure SignalR Service REST APIs

Actions	Description
none
NotActions
none
DataActions
Microsoft.SignalRService/SignalR/group/read	Check group existence or user existence in group
Microsoft.SignalRService/SignalR/clientConnection/read	Check client connection existence
Microsoft.SignalRService/SignalR/user/read	Check user existence
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Read-only access to Azure SignalR Service REST APIs",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/ddde6b66-c0df-4114-a159-3618637b3035",
  "name": "ddde6b66-c0df-4114-a159-3618637b3035",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.SignalRService/SignalR/group/read",
        "Microsoft.SignalRService/SignalR/clientConnection/read",
        "Microsoft.SignalRService/SignalR/user/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "SignalR REST API Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

SignalR Service Owner

Full access to Azure SignalR Service REST APIs

Actions	Description
none
NotActions
none
DataActions
Microsoft.SignalRService/SignalR/*
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Full access to Azure SignalR Service REST APIs",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/7e4f1700-ea5a-4f59-8f37-079cfe29dce3",
  "name": "7e4f1700-ea5a-4f59-8f37-079cfe29dce3",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.SignalRService/SignalR/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "SignalR Service Owner",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

SignalR/Web PubSub Contributor

Create, Read, Update, and Delete SignalR service resources

Actions	Description
Microsoft.SignalRService/*
Microsoft.Authorization/*/read	Read roles and role assignments
Microsoft.Insights/alertRules/*	Create and manage a classic metric alert
Microsoft.Resources/subscriptions/resourceGroups/read	Gets or lists resource groups.
Microsoft.Resources/deployments/*	Create and manage a deployment
Microsoft.Support/*	Create and update a support ticket
NotActions
none
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Create, Read, Update, and Delete SignalR service resources",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/8cf5e20a-e4b2-4e9d-b3a1-5ceb692c2761",
  "name": "8cf5e20a-e4b2-4e9d-b3a1-5ceb692c2761",
  "permissions": [
    {
      "actions": [
        "Microsoft.SignalRService/*",
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "SignalR/Web PubSub Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Web Plan Contributor

Manage the web plans for websites. Does not allow you to assign roles in Azure RBAC.

Actions	Description
Microsoft.Authorization/*/read	Read roles and role assignments
Microsoft.Insights/alertRules/*	Create and manage a classic metric alert
Microsoft.ResourceHealth/availabilityStatuses/read	Gets the availability statuses for all resources in the specified scope
Microsoft.Resources/deployments/*	Create and manage a deployment
Microsoft.Resources/subscriptions/resourceGroups/read	Gets or lists resource groups.
Microsoft.Support/*	Create and update a support ticket
Microsoft.Web/serverFarms/*	Create and manage server farms
Microsoft.Web/hostingEnvironments/Join/Action	Joins an App Service Environment
Microsoft.Insights/autoscalesettings/*
NotActions
none
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you manage the web plans for websites, but not access to them.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/2cc479cb-7b4d-49a8-b449-8c00fd0f0a4b",
  "name": "2cc479cb-7b4d-49a8-b449-8c00fd0f0a4b",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.ResourceHealth/availabilityStatuses/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*",
        "Microsoft.Web/serverFarms/*",
        "Microsoft.Web/hostingEnvironments/Join/Action",
        "Microsoft.Insights/autoscalesettings/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Web Plan Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Web PubSub Service Owner

Full access to Azure Web PubSub Service REST APIs

Learn more

Actions	Description
none
NotActions
none
DataActions
Microsoft.SignalRService/WebPubSub/*
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Full access to Azure Web PubSub Service REST APIs",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/12cf5a90-567b-43ae-8102-96cf46c7d9b4",
  "name": "12cf5a90-567b-43ae-8102-96cf46c7d9b4",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.SignalRService/WebPubSub/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Web PubSub Service Owner",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Web PubSub Service Reader

Read-only access to Azure Web PubSub Service REST APIs

Learn more

Actions	Description
none
NotActions
none
DataActions
Microsoft.SignalRService/WebPubSub/*/read
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Read-only access to Azure Web PubSub Service REST APIs",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/bfb1c7d2-fb1a-466b-b2ba-aee63b92deaf",
  "name": "bfb1c7d2-fb1a-466b-b2ba-aee63b92deaf",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.SignalRService/WebPubSub/*/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Web PubSub Service Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Website Contributor

Manage websites, but not web plans. Does not allow you to assign roles in Azure RBAC.

Actions	Description
Microsoft.Authorization/*/read	Read roles and role assignments
Microsoft.Insights/alertRules/*	Create and manage a classic metric alert
Microsoft.Insights/components/*	Create and manage Insights components
Microsoft.ResourceHealth/availabilityStatuses/read	Gets the availability statuses for all resources in the specified scope
Microsoft.Resources/deployments/*	Create and manage a deployment
Microsoft.Resources/subscriptions/resourceGroups/read	Gets or lists resource groups.
Microsoft.Support/*	Create and update a support ticket
Microsoft.Web/certificates/*	Create and manage website certificates
Microsoft.Web/listSitesAssignedToHostName/read	Get names of sites assigned to hostname.
Microsoft.Web/register/action	Register Microsoft.Web resource provider for the subscription.
Microsoft.Web/serverFarms/join/action	Joins an App Service Plan
Microsoft.Web/serverFarms/read	Get the properties on an App Service Plan
Microsoft.Web/sites/*	Create and manage websites (site creation also requires write permissions to the associated App Service Plan)
NotActions
none
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you manage websites (not web plans), but not access to them.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/de139f84-1756-47ae-9be6-808fbbe84772",
  "name": "de139f84-1756-47ae-9be6-808fbbe84772",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Insights/components/*",
        "Microsoft.ResourceHealth/availabilityStatuses/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*",
        "Microsoft.Web/certificates/*",
        "Microsoft.Web/listSitesAssignedToHostName/read",
        "Microsoft.Web/register/action",
        "Microsoft.Web/serverFarms/join/action",
        "Microsoft.Web/serverFarms/read",
        "Microsoft.Web/sites/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Website Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Next steps

Assign Azure roles using the Azure portal

Kopīgot, izmantojot

Azure built-in roles for Web and Mobile

Azure Maps Data Contributor

Azure Maps Data Reader

Azure Maps Search and Render Data Reader

Azure Spring Apps Application Configuration Service Config File Pattern Reader Role

Azure Spring Apps Application Configuration Service Log Reader Role

Azure Spring Apps Connect Role

Azure Spring Apps Job Log Reader Role

Azure Spring Apps Remote Debugging Role

Azure Spring Apps Spring Cloud Gateway Log Reader Role

Azure Spring Cloud Config Server Contributor

Azure Spring Cloud Config Server Reader

Azure Spring Cloud Data Reader

Azure Spring Cloud Service Registry Contributor

Azure Spring Cloud Service Registry Reader

Media Services Account Administrator

Media Services Live Events Administrator

Media Services Media Operator

Media Services Policy Administrator

Media Services Streaming Endpoints Administrator

SignalR AccessKey Reader

SignalR App Server

SignalR REST API Owner

SignalR REST API Reader

SignalR Service Owner

SignalR/Web PubSub Contributor

Web Plan Contributor

Web PubSub Service Owner

Web PubSub Service Reader

Website Contributor

Next steps

Atsauksmes

Papildu resursi