Azure Monitor built-in role

Data Purger

Authorizes purge operations for Application Insights and Log Analytics data. Azure RBAC publishes purge as control-plane Actions and the role has no DataActions, but invoking those Actions deletes matching analytics records through a destructive, non-reversible data operation.

Control-plane actions (4)

• Microsoft.Insights/components/*/read
• Microsoft.Insights/components/purge/action
• Microsoft.OperationalInsights/workspaces/*/read
• Microsoft.OperationalInsights/workspaces/purge/action

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the specific Log Analytics workspace or Application Insights resource containing the personal data that must be purged. A resource-group or broader assignment is inherited by every matching analytics resource below that scope.

Common use cases (2)

• Submit a Log Analytics Purge API request when deletion is required to satisfy a GDPR personal-data request.
• Check the asynchronous purge status after the approved request is submitted.

Prerequisites (2)

• Identify the personal data, table, columns, and predicates and run a query first to verify the records that the purge request will match.
• Use purge only for GDPR-required deletion; Microsoft recommends the Delete Data API for other supported deletions and does not support purge for Basic or Auxiliary tables.

Best practices (3)

• Prefer preventing, filtering, obfuscating, or anonymizing personal data during collection before relying on deletion.
• Batch user identities into a single predicate when possible and remain within the documented limit of 50 purge requests per hour.
• Use the narrow workspace or component scope so purge authority does not extend to unrelated analytics stores.

Security considerations (3)

• Delete and purge operations are destructive and non-reversible.
• The formal purge completion SLA is 30 days and the operation cannot be expedited, so the status must be tracked as an asynchronous compliance workflow.
• Control-plane classification does not make this role nondestructive; the purge Actions remove matching analytics data.

Assignment guidance

Grant Data Purger only at the Log Analytics workspace or Application Insights resource covered by an approved GDPR request. Verify the query predicate before submission and avoid a parent scope that includes unrelated analytics data.

Related roles (1)

• Log Analytics Contributor: Microsoft documents Log Analytics Contributor as also providing workspace purge permission, while Data Purger isolates the purge function from broader workspace administration.

Editorial sources (5)

• Azure built-in roles for Monitor →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Manage personal data in Azure Monitor Logs →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →