Azure AI + machine learning built-in role
Cognitive Services Immersive Reader User
Creates Immersive Reader sessions and calls the Immersive Reader content-model API. The role contains a single data-plane DataAction and no Azure resource-management Actions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: b2de6794-95db-4659-8781-7e080d3f2b9d
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (1)
Microsoft.CognitiveServices/accounts/ImmersiveReader/getcontentmodelforreader/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign to the application service principal on the individual Immersive Reader resource. A resource-group or subscription assignment is inherited by other Immersive Reader resources and is broader than the documented setup.
Common use cases (2)
- Authorize an application to obtain Microsoft Entra tokens and create Immersive Reader sessions for its users.
- Separate runtime session creation from Azure resource provisioning and Microsoft Entra application administration.
Prerequisites (3)
- Create an Immersive Reader resource with a custom subdomain and a Microsoft Entra application and service principal.
- Resource setup requires Azure Contributor at subscription scope and Microsoft Entra Application Developer when the administrator is not subscription Owner.
- Configure and protect the application credential used to obtain Microsoft Entra access tokens.
Best practices (3)
- Assign the runtime role to the service principal directly on the Immersive Reader resource.
- Use separate resources and service principals for development and production or for regions that require independent access boundaries.
- Rotate application credentials and remove the role assignment when the application no longer uses the resource.
Security considerations (3)
- The role can create sessions and submit content to Immersive Reader but cannot manage the Azure resource.
- The application secret or certificate used to obtain tokens is a separate credential that must be protected and rotated.
- A parent-scope assignment lets the application create sessions against multiple inherited resources.
Assignment guidance
Assign Cognitive Services Immersive Reader User to the application service principal at the Immersive Reader resource scope after Microsoft Entra authentication is configured. Keep Azure provisioning and Entra application creation permissions with the setup administrator.
Related roles (2)
- Application Developer: The existing Microsoft Entra directory role Microsoft documents as a setup prerequisite for creating the application when the administrator is not subscription Owner.
- Contributor: The Azure control-plane role Microsoft documents for resource setup; it is separate from runtime session access.
Common questions
When should I assign the Cognitive Services Immersive Reader User Azure role?
Assign Cognitive Services Immersive Reader User when you need to: Authorize an application to obtain Microsoft Entra tokens and create Immersive Reader sessions for its users.; and Separate runtime session creation from Azure resource provisioning and Microsoft Entra application administration.. Practical scope: Assign to the application service principal on the individual Immersive Reader resource. A resource-group or subscription assignment is inherited by other Immersive Reader resources and is broader than the documented setup.
What permissions does the Cognitive Services Immersive Reader User Azure role grant?
The role definition grants 1 combined control-plane and data-plane actions. Representative operations include: Microsoft.CognitiveServices/accounts/ImmersiveReader/getcontentmodelforreader/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Cognitive Services Immersive Reader User Azure role?
Key considerations when assigning Cognitive Services Immersive Reader User: The role can create sessions and submit content to Immersive Reader but cannot manage the Azure resource.; The application secret or certificate used to obtain tokens is a separate credential that must be protected and rotated.; and A parent-scope assignment lets the application create sessions against multiple inherited resources.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for AI + machine learning - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role - Azure RBAC | Microsoft Learn →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC | Microsoft Learn →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC | Microsoft Learn →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Create an Immersive Reader resource - Azure AI services | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.