Azure Monitor built-in role
Application Insights Snapshot Debugger
Views and downloads debug snapshots collected by Application Insights Snapshot Debugger. The role uses control-plane Actions and no DataActions, but the snapshots can contain source context, call stacks, parameters, and local variables.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 08954f03-6346-4c2e-81c0-ec3a5cfae23b
Control-plane actions (7)
Microsoft.Authorization/*/readMicrosoft.Insights/alertRules/*Microsoft.Insights/components/*/readMicrosoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.Support/*Microsoft.Insights/snapshots/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the Application Insights resource whose snapshots the user must inspect. Microsoft states that this built-in role must be granted directly to the user and is not recognized when its permissions are added to a custom role.
Common use cases (2)
- Open an exception snapshot in the Azure portal to inspect its call stack, parameters, and local variables.
- Download an authorized snapshot as a .diagsession file for debugging in Visual Studio Enterprise.
Prerequisites (2)
- Snapshot Debugger must be enabled for a supported .NET application and a snapshot must have been collected for the exception being investigated.
- The investigator must receive the Application Insights Snapshot Debugger built-in role directly; Owner and Contributor do not include this access, and a custom role containing the permissions is not recognized.
Best practices (2)
- Assign the built-in role directly on the Application Insights resource instead of broadening access to unrelated monitoring resources.
- Limit snapshot access to investigators who need production debugging data and remove access when that responsibility ends.
Security considerations (2)
- Microsoft warns that snapshots might include sensitive information exposed through parameters and local variables.
- Downloaded .diagsession files and included symbol files remain sensitive outside the Azure portal and require the same handling controls as the source snapshot.
Assignment guidance
Grant the Application Insights Snapshot Debugger built-in role directly to the named user at the Application Insights resource scope. Do not rely on Owner, Contributor, a group assignment, or a custom role containing the snapshot permission.
Related roles (2)
- Owner: Microsoft explicitly states that Owner does not include Snapshot Debugger access.
- Contributor: Microsoft explicitly states that Contributor does not include Snapshot Debugger access.
Common questions
When should I assign the Application Insights Snapshot Debugger Azure role?
Assign Application Insights Snapshot Debugger when you need to: Open an exception snapshot in the Azure portal to inspect its call stack, parameters, and local variables.; and Download an authorized snapshot as a .diagsession file for debugging in Visual Studio Enterprise.. Practical scope: Assign on the Application Insights resource whose snapshots the user must inspect. Microsoft states that this built-in role must be granted directly to the user and is not recognized when its permissions are added to a custom role.
What permissions does the Application Insights Snapshot Debugger Azure role grant?
The role definition grants 7 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; Microsoft.Insights/components/*/read; Microsoft.Resources/deployments/*; Microsoft.Resources/subscriptions/resourceGroups/read; and Microsoft.Support/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Application Insights Snapshot Debugger Azure role?
Key considerations when assigning Application Insights Snapshot Debugger: Microsoft warns that snapshots might include sensitive information exposed through parameters and local variables.; and Downloaded .diagsession files and included symbol files remain sensitive outside the Azure portal and require the same handling controls as the source snapshot.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Monitor →
Supports: Description, Practical scope, Prerequisites, Best practices, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-16.
- View Application Insights Snapshot Debugger data →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.
- Debug exceptions in .NET applications using Snapshot Debugger →
Supports: Prerequisites. Retrieved 2026-07-16.