Azure Integration built-in role
App Configuration Reader
Reads App Configuration resource metadata through the Azure Resource Manager control plane. It has no DataActions, does not expose access keys, and does not grant access to key-values, snapshots, or feature flags stored in the service.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 175b81b9-6e0d-490a-85e4-0d422273c10c
Control-plane actions (5)
Microsoft.AppConfiguration/*/readMicrosoft.Authorization/*/readMicrosoft.Insights/alertRules/readMicrosoft.Resources/deployments/readMicrosoft.Resources/subscriptions/resourceGroups/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual App Configuration store for store-specific visibility. Resource-group and subscription assignments are inherited and expose metadata for every App Configuration store below them.
Common use cases (2)
- Let an auditor or support engineer inspect App Configuration store properties without reading configuration data or access keys.
- Monitor store resources while workload identities retain separate data-plane assignments.
Prerequisites (2)
- The App Configuration store to inspect must already exist.
- If the reviewer also needs configuration values, assign App Configuration Data Reader separately.
Best practices (2)
- Use this role instead of App Configuration Contributor when no resource change or access-key operation is required.
- Keep control-plane resource visibility and data-plane configuration access as separate assignments.
Security considerations (2)
- The role exposes store properties and supporting deployment and alert metadata but not configuration data or access keys.
- It cannot modify the store, recover or purge deleted stores, or perform direct data-plane operations.
Assignment guidance
Assign App Configuration Reader directly on the store to observers who need only resource metadata. Add Data Reader for configuration-data reads or Contributor for approved resource lifecycle management, rather than broadening this assignment by default.
Related roles (2)
- App Configuration Contributor: Adds store management and access-key exposure while still not granting direct Microsoft Entra data access.
- App Configuration Data Reader: Reads configuration data through the data plane without control-plane store access.
Common questions
When should I assign the App Configuration Reader Azure role?
Assign App Configuration Reader when you need to: Let an auditor or support engineer inspect App Configuration store properties without reading configuration data or access keys.; and Monitor store resources while workload identities retain separate data-plane assignments.. Practical scope: Assign on the individual App Configuration store for store-specific visibility. Resource-group and subscription assignments are inherited and expose metadata for every App Configuration store below them.
What permissions does the App Configuration Reader Azure role grant?
The role definition grants 5 combined control-plane and data-plane actions. Representative operations include: Microsoft.AppConfiguration/*/read; Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/read; Microsoft.Resources/deployments/read; and Microsoft.Resources/subscriptions/resourceGroups/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the App Configuration Reader Azure role?
Key considerations when assigning App Configuration Reader: The role exposes store properties and supporting deployment and alert metadata but not configuration data or access keys.; and It cannot modify the store, recover or purge deleted stores, or perform direct data-plane operations.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Access Azure App Configuration using Microsoft Entra ID →
Supports: Description, Practical scope, Common use cases, Prerequisites, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Secure your Azure App Configuration →
Supports: Best practices, Security considerations. Retrieved 2026-07-17.