Azure Monitor built-in role

Application Insights Snapshot Debugger

Views and downloads debug snapshots collected by Application Insights Snapshot Debugger. The role uses control-plane Actions and no DataActions, but the snapshots can contain source context, call stacks, parameters, and local variables.

Control-plane actions (7)

• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Insights/components/*/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Support/*
• Microsoft.Insights/snapshots/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the Application Insights resource whose snapshots the user must inspect. Microsoft states that this built-in role must be granted directly to the user and is not recognized when its permissions are added to a custom role.

Common use cases (2)

• Open an exception snapshot in the Azure portal to inspect its call stack, parameters, and local variables.
• Download an authorized snapshot as a .diagsession file for debugging in Visual Studio Enterprise.

Prerequisites (2)

• Snapshot Debugger must be enabled for a supported .NET application and a snapshot must have been collected for the exception being investigated.
• The investigator must receive the Application Insights Snapshot Debugger built-in role directly; Owner and Contributor do not include this access, and a custom role containing the permissions is not recognized.

Best practices (2)

• Assign the built-in role directly on the Application Insights resource instead of broadening access to unrelated monitoring resources.
• Limit snapshot access to investigators who need production debugging data and remove access when that responsibility ends.

Security considerations (2)

• Microsoft warns that snapshots might include sensitive information exposed through parameters and local variables.
• Downloaded .diagsession files and included symbol files remain sensitive outside the Azure portal and require the same handling controls as the source snapshot.

Assignment guidance

Grant the Application Insights Snapshot Debugger built-in role directly to the named user at the Application Insights resource scope. Do not rely on Owner, Contributor, a group assignment, or a custom role containing the snapshot permission.

Related roles (2)

• Owner: Microsoft explicitly states that Owner does not include Snapshot Debugger access.
• Contributor: Microsoft explicitly states that Contributor does not include Snapshot Debugger access.

Editorial sources (6)

• Azure built-in roles for Monitor →

  Supports: Description, Practical scope, Prerequisites, Best practices, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• View Application Insights Snapshot Debugger data →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• Debug exceptions in .NET applications using Snapshot Debugger →

  Supports: Prerequisites. Retrieved 2026-07-16.

Official Microsoft Learn documentation →