Azure Compute built-in role
Azure Batch Account Reader
Views Azure Batch account resources, including applications, pools, jobs, and job schedules. Its read access is present in both Azure Resource Manager Actions and Batch service DataActions; it does not create, update, or delete those resources.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 11076f67-66f6-4be0-8f6b-f0609fd05cc9
Control-plane actions (2)
Microsoft.Batch/*/readMicrosoft.Resources/subscriptions/resourceGroups/read
Data-plane actions (1)
Microsoft.Batch/*/read
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign at the individual Batch account for account-specific visibility. Resource-group, subscription, or management-group assignments are inherited by contained Batch accounts. The role reads both Batch control-plane configuration and Batch data-plane workload metadata.
Common use cases (2)
- Give support, audit, or operations personnel visibility into Batch account configuration, pools, jobs, and schedules without change permissions.
- Allow monitoring automation to inspect Batch resources and workload state by using Microsoft Entra authentication.
Prerequisites (2)
- The client must authenticate with Microsoft Entra ID; Batch shared-key authentication is not constrained by this read-only role.
- Determine whether job and schedule metadata is appropriate for the reader because this role includes Batch DataActions, not only management-plane reads.
Best practices (3)
- Assign at the Batch account rather than a parent scope unless visibility across all inherited accounts is required.
- Keep secrets out of job and task metadata and use customer-managed keys when the workload requires control of encryption keys.
- Use private endpoints or restricted network access and prefer Microsoft Entra authentication over shared keys.
Security considerations (3)
- Although it cannot modify Batch resources, the role can expose account configuration plus pool, application, job, and schedule metadata.
- Its Batch DataActions make it broader than an Azure Resource Manager-only reader for the account.
- Shared-key credentials grant full Batch access independently and must not be distributed to read-only users.
Assignment guidance
Use Azure Batch Account Reader for principals that must inspect both management and workload state without changes. Scope it to the Batch account and move to Job Submitter or Data Contributor only when the documented write operations are required.
Related roles (2)
- Azure Batch Job Submitter: Adds job and schedule management while retaining read access to existing pools and applications.
- Azure Batch Data Contributor: Adds pool, application, job, and schedule management without Batch account modification.
Common questions
When should I assign the Azure Batch Account Reader Azure role?
Assign Azure Batch Account Reader when you need to: Give support, audit, or operations personnel visibility into Batch account configuration, pools, jobs, and schedules without change permissions.; and Allow monitoring automation to inspect Batch resources and workload state by using Microsoft Entra authentication.. Practical scope: Assign at the individual Batch account for account-specific visibility. Resource-group, subscription, or management-group assignments are inherited by contained Batch accounts. The role reads both Batch control-plane configuration and Batch data-plane workload metadata.
What permissions does the Azure Batch Account Reader Azure role grant?
The role definition grants 3 combined control-plane and data-plane actions. Representative operations include: Microsoft.Batch/*/read; Microsoft.Resources/subscriptions/resourceGroups/read; and Microsoft.Batch/*/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Batch Account Reader Azure role?
Key considerations when assigning Azure Batch Account Reader: Although it cannot modify Batch resources, the role can expose account configuration plus pool, application, job, and schedule metadata.; Its Batch DataActions make it broader than an Azure Resource Manager-only reader for the account.; and Shared-key credentials grant full Batch access independently and must not be distributed to read-only users.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Compute →
Supports: Description, Practical scope. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Role-based access control for Azure Batch service →
Supports: Description, Practical scope, Common use cases, Prerequisites, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Batch security and compliance best practices →
Supports: Best practices, Security considerations. Retrieved 2026-07-16.