Azure Compute built-in role

Azure Batch Account Reader

Views Azure Batch account resources, including applications, pools, jobs, and job schedules. Its read access is present in both Azure Resource Manager Actions and Batch service DataActions; it does not create, update, or delete those resources.

Control-plane actions (2)

• Microsoft.Batch/*/read
• Microsoft.Resources/subscriptions/resourceGroups/read

Data-plane actions (1)

• Microsoft.Batch/*/read

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign at the individual Batch account for account-specific visibility. Resource-group, subscription, or management-group assignments are inherited by contained Batch accounts. The role reads both Batch control-plane configuration and Batch data-plane workload metadata.

Common use cases (2)

• Give support, audit, or operations personnel visibility into Batch account configuration, pools, jobs, and schedules without change permissions.
• Allow monitoring automation to inspect Batch resources and workload state by using Microsoft Entra authentication.

Prerequisites (2)

• The client must authenticate with Microsoft Entra ID; Batch shared-key authentication is not constrained by this read-only role.
• Determine whether job and schedule metadata is appropriate for the reader because this role includes Batch DataActions, not only management-plane reads.

Best practices (3)

• Assign at the Batch account rather than a parent scope unless visibility across all inherited accounts is required.
• Keep secrets out of job and task metadata and use customer-managed keys when the workload requires control of encryption keys.
• Use private endpoints or restricted network access and prefer Microsoft Entra authentication over shared keys.

Security considerations (3)

• Although it cannot modify Batch resources, the role can expose account configuration plus pool, application, job, and schedule metadata.
• Its Batch DataActions make it broader than an Azure Resource Manager-only reader for the account.
• Shared-key credentials grant full Batch access independently and must not be distributed to read-only users.

Assignment guidance

Use Azure Batch Account Reader for principals that must inspect both management and workload state without changes. Scope it to the Batch account and move to Job Submitter or Data Contributor only when the documented write operations are required.

Related roles (2)

• Azure Batch Job Submitter: Adds job and schedule management while retaining read access to existing pools and applications.
• Azure Batch Data Contributor: Adds pool, application, job, and schedule management without Batch account modification.

Editorial sources (6)

• Azure built-in roles for Compute →

  Supports: Description, Practical scope. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Role-based access control for Azure Batch service →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Batch security and compliance best practices →

  Supports: Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →