Azure Integration built-in role

App Configuration Data Owner

Provides direct Microsoft Entra data-plane read, write, delete, and action access to App Configuration data, including key-values, snapshots, and feature flags. It grants no control-plane Actions for managing the App Configuration store resource.

Control-plane actions (0)

None — this role grants no control-plane management actions.

Data-plane actions (4)

• Microsoft.AppConfiguration/configurationStores/*/read
• Microsoft.AppConfiguration/configurationStores/*/write
• Microsoft.AppConfiguration/configurationStores/*/delete
• Microsoft.AppConfiguration/configurationStores/*/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the individual App Configuration store whose data the principal manages. Resource-group and subscription assignments are inherited by all stores below them and extend full configuration-data access to each inherited store.

Common use cases (2)

• Authorize a deployment or configuration-management identity to create, update, and delete configuration data in one store.
• Let a tightly controlled operations team manage key-values, snapshots, and feature flags through Microsoft Entra authentication.

Prerequisites (2)

• The App Configuration store must exist and the principal must authenticate to its data endpoint with a Microsoft Entra token.
• The workload must require writes or deletes; read-only workloads should use App Configuration Data Reader.

Best practices (3)

• Assign to a managed identity when an Azure-hosted application writes configuration data, avoiding stored application credentials.
• Use Data Reader for runtime applications that only consume configuration, and keep store lifecycle management on a separate control-plane role.
• Allow up to 15 minutes for a new or changed data-role assignment to propagate before troubleshooting access.

Security considerations (3)

• The role can read, replace, and delete application settings and feature flags, which can change application behavior or expose sensitive configuration values.
• It does not manage the store resource, networking, access-key authentication setting, or Azure role assignments.
• A parent-scope assignment gives full data access to every inherited App Configuration store.

Assignment guidance

Assign App Configuration Data Owner to the deployment or configuration-management identity directly on the target store. Use Data Reader for consumers and grant App Configuration Contributor separately only to principals that manage the store resource.

Related roles (2)

• App Configuration Data Reader: Limits direct Microsoft Entra data access to reads.
• App Configuration Contributor: Manages the store control plane but does not directly grant Microsoft Entra data access.

Editorial sources (7)

• Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Access Azure App Configuration using Microsoft Entra ID →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Secure your Azure App Configuration →

  Supports: Best practices, Security considerations. Retrieved 2026-07-17.

Official Microsoft Learn documentation →