Azure Integration built-in role
App Configuration Data Owner
Provides direct Microsoft Entra data-plane read, write, delete, and action access to App Configuration data, including key-values, snapshots, and feature flags. It grants no control-plane Actions for managing the App Configuration store resource.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 5ae67dd6-50cb-40e7-96ff-dc2bfa4b606b
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (4)
Microsoft.AppConfiguration/configurationStores/*/readMicrosoft.AppConfiguration/configurationStores/*/writeMicrosoft.AppConfiguration/configurationStores/*/deleteMicrosoft.AppConfiguration/configurationStores/*/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual App Configuration store whose data the principal manages. Resource-group and subscription assignments are inherited by all stores below them and extend full configuration-data access to each inherited store.
Common use cases (2)
- Authorize a deployment or configuration-management identity to create, update, and delete configuration data in one store.
- Let a tightly controlled operations team manage key-values, snapshots, and feature flags through Microsoft Entra authentication.
Prerequisites (2)
- The App Configuration store must exist and the principal must authenticate to its data endpoint with a Microsoft Entra token.
- The workload must require writes or deletes; read-only workloads should use App Configuration Data Reader.
Best practices (3)
- Assign to a managed identity when an Azure-hosted application writes configuration data, avoiding stored application credentials.
- Use Data Reader for runtime applications that only consume configuration, and keep store lifecycle management on a separate control-plane role.
- Allow up to 15 minutes for a new or changed data-role assignment to propagate before troubleshooting access.
Security considerations (3)
- The role can read, replace, and delete application settings and feature flags, which can change application behavior or expose sensitive configuration values.
- It does not manage the store resource, networking, access-key authentication setting, or Azure role assignments.
- A parent-scope assignment gives full data access to every inherited App Configuration store.
Assignment guidance
Assign App Configuration Data Owner to the deployment or configuration-management identity directly on the target store. Use Data Reader for consumers and grant App Configuration Contributor separately only to principals that manage the store resource.
Related roles (2)
- App Configuration Data Reader: Limits direct Microsoft Entra data access to reads.
- App Configuration Contributor: Manages the store control plane but does not directly grant Microsoft Entra data access.
Common questions
When should I assign the App Configuration Data Owner Azure role?
Assign App Configuration Data Owner when you need to: Authorize a deployment or configuration-management identity to create, update, and delete configuration data in one store.; and Let a tightly controlled operations team manage key-values, snapshots, and feature flags through Microsoft Entra authentication.. Practical scope: Assign on the individual App Configuration store whose data the principal manages. Resource-group and subscription assignments are inherited by all stores below them and extend full configuration-data access to each inherited store.
What permissions does the App Configuration Data Owner Azure role grant?
The role definition grants 4 combined control-plane and data-plane actions. Representative operations include: Microsoft.AppConfiguration/configurationStores/*/read; Microsoft.AppConfiguration/configurationStores/*/write; Microsoft.AppConfiguration/configurationStores/*/delete; and Microsoft.AppConfiguration/configurationStores/*/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the App Configuration Data Owner Azure role?
Key considerations when assigning App Configuration Data Owner: The role can read, replace, and delete application settings and feature flags, which can change application behavior or expose sensitive configuration values.; It does not manage the store resource, networking, access-key authentication setting, or Azure role assignments.; and A parent-scope assignment gives full data access to every inherited App Configuration store.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Access Azure App Configuration using Microsoft Entra ID →
Supports: Description, Practical scope, Common use cases, Prerequisites, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Secure your Azure App Configuration →
Supports: Best practices, Security considerations. Retrieved 2026-07-17.