Azure Integration built-in role
App Configuration Data Reader
Provides direct Microsoft Entra read access to App Configuration data, including key-values and snapshots. It contains data-plane DataActions only and grants no control-plane access to manage or inspect the App Configuration store resource.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 516239f1-63e1-4d78-a4de-a74fb236a071
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (1)
Microsoft.AppConfiguration/configurationStores/*/read
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual App Configuration store consumed by the principal. A resource-group or subscription assignment is inherited by all stores below it and exposes configuration data from each inherited store.
Common use cases (2)
- Allow a runtime application to read configuration values and feature flags from one store using Microsoft Entra authentication.
- Give a reviewer read-only access to configuration data without store lifecycle or data-write authority.
Prerequisites (2)
- The App Configuration store must exist and the application or user must authenticate to the data endpoint with a Microsoft Entra token.
- The workload must not require creating, changing, or deleting configuration data.
Best practices (3)
- Assign the role to a managed identity for Azure-hosted applications instead of storing access keys or application secrets.
- Assign directly on one store and use Data Owner only for an approved data-write workflow.
- Allow up to 15 minutes for assignment propagation before diagnosing an authorization failure.
Security considerations (3)
- Configuration data can contain endpoints, feature rollout state, and other sensitive application settings even though the role cannot modify them.
- The role does not expose store access keys or grant control-plane resource reads by itself.
- A parent-scope assignment exposes data in every inherited App Configuration store.
Assignment guidance
Assign App Configuration Data Reader directly on the store to the managed identity or user that only consumes configuration. Add App Configuration Reader separately only when the principal also needs control-plane resource metadata.
Related roles (2)
- App Configuration Data Owner: Adds direct data-plane write, delete, and action access.
- App Configuration Reader: Reads the store resource control plane without reading configuration data.
Common questions
When should I assign the App Configuration Data Reader Azure role?
Assign App Configuration Data Reader when you need to: Allow a runtime application to read configuration values and feature flags from one store using Microsoft Entra authentication.; and Give a reviewer read-only access to configuration data without store lifecycle or data-write authority.. Practical scope: Assign on the individual App Configuration store consumed by the principal. A resource-group or subscription assignment is inherited by all stores below it and exposes configuration data from each inherited store.
What permissions does the App Configuration Data Reader Azure role grant?
The role definition grants 1 combined control-plane and data-plane actions. Representative operations include: Microsoft.AppConfiguration/configurationStores/*/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the App Configuration Data Reader Azure role?
Key considerations when assigning App Configuration Data Reader: Configuration data can contain endpoints, feature rollout state, and other sensitive application settings even though the role cannot modify them.; The role does not expose store access keys or grant control-plane resource reads by itself.; and A parent-scope assignment exposes data in every inherited App Configuration store.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Access Azure App Configuration using Microsoft Entra ID →
Supports: Description, Practical scope, Common use cases, Prerequisites, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Secure your Azure App Configuration →
Supports: Best practices, Security considerations. Retrieved 2026-07-17.