Azure Integration built-in role

App Configuration Contributor

Performs App Configuration resource management operations except purging a deleted store. This control-plane role has no DataActions, but its wildcard can list and regenerate store API keys, which can be used to access all store data outside the direct Microsoft Entra data-role boundary.

Control-plane actions (5)

• Microsoft.AppConfiguration/*
• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (1)

• Microsoft.AppConfiguration/locations/deletedConfigurationStores/purge/action

Assignable scopes (1)

• /

Practical scope

Assign on an existing App Configuration store when one store is administered. Creating a store or recovering a deleted store requires the write permission at the containing resource group or subscription; reading deleted stores requires subscription scope because deleted stores exist outside resource groups.

Common use cases (3)

• Configure, update, or delete an existing App Configuration store without granting management rights over unrelated Azure resource providers.
• Create or recover a store only through a resource-group or subscription assignment that covers the target resource path.
• Manage store properties and access-key authentication settings while data access through Microsoft Entra ID remains separately assigned.

Prerequisites (3)

• Confirm the principal needs store lifecycle and property management rather than only configuration-data access.
• For creation or recovery, choose the containing resource group and assign the role there or at subscription scope; direct scope on an existing store cannot authorize a new or deleted resource.
• Define whether access-key authentication remains enabled and how listed or regenerated API keys are protected, distributed, and rotated.

Best practices (3)

• Use App Configuration Reader for resource inspection and assign Data Reader or Data Owner separately for direct Microsoft Entra data access.
• Prefer Microsoft Entra authentication and managed identities for applications, and disable access-key authentication when compatible with the workload.
• Use general Contributor only when deleted-store purge or broader Azure resource management is explicitly required.

Security considerations (5)

• The wildcard includes `configurationStores/ListKeys/action` and `configurationStores/RegenerateKey/action`; listed keys provide indirect access to all store data, while regeneration can invalidate clients that use the replaced key.
• The role can change or delete an existing store. At resource-group or subscription scope it can recover a deleted store, but it cannot purge one; reading deleted stores requires subscription scope.
• Recovering a store does not restore its prior Azure role assignments, managed identity, Event Grid subscriptions, or private endpoints.
• A parent-scope assignment exposes key listing and regeneration for every inherited App Configuration store.
• The published supporting Actions include `Microsoft.Insights/alertRules/*`; a resource-group or subscription assignment extends that classic alert-rule wildcard beyond the individual store.

Assignment guidance

Assign App Configuration Contributor directly on an existing store only to administrators approved to list and regenerate its API keys. Use a dedicated resource-group assignment only when the platform group must create or recover that store, and use subscription scope only for documented deleted-store discovery. Assign Data Reader or Data Owner separately to workload identities; this control-plane role is not a data-plane least-privilege substitute.

Related roles (3)

• App Configuration Reader: Reads App Configuration resources without access keys or configuration data.
• App Configuration Data Owner: Provides direct Microsoft Entra read, write, delete, and action access to store data without resource management.
• Contributor: Microsoft documents this broader Azure role for App Configuration management including purging a deleted store.

Editorial sources (9)

• Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-17.

• Access Azure App Configuration using Microsoft Entra ID →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Permissions for Integration - Microsoft.AppConfiguration →

  Supports: Description, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Secure your Azure App Configuration →

  Supports: Prerequisites, Best practices, Security considerations. Retrieved 2026-07-17.

• Soft delete in Azure App Configuration →

  Supports: Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

Official Microsoft Learn documentation →