Azure Monitor built-in role
Data Purger
Authorizes purge operations for Application Insights and Log Analytics data. Azure RBAC publishes purge as control-plane Actions and the role has no DataActions, but invoking those Actions deletes matching analytics records through a destructive, non-reversible data operation.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 150f5e0c-0603-4f03-8c7f-cf70034c4e90
Control-plane actions (4)
Microsoft.Insights/components/*/readMicrosoft.Insights/components/purge/actionMicrosoft.OperationalInsights/workspaces/*/readMicrosoft.OperationalInsights/workspaces/purge/action
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the specific Log Analytics workspace or Application Insights resource containing the personal data that must be purged. A resource-group or broader assignment is inherited by every matching analytics resource below that scope.
Common use cases (2)
- Submit a Log Analytics Purge API request when deletion is required to satisfy a GDPR personal-data request.
- Check the asynchronous purge status after the approved request is submitted.
Prerequisites (2)
- Identify the personal data, table, columns, and predicates and run a query first to verify the records that the purge request will match.
- Use purge only for GDPR-required deletion; Microsoft recommends the Delete Data API for other supported deletions and does not support purge for Basic or Auxiliary tables.
Best practices (3)
- Prefer preventing, filtering, obfuscating, or anonymizing personal data during collection before relying on deletion.
- Batch user identities into a single predicate when possible and remain within the documented limit of 50 purge requests per hour.
- Use the narrow workspace or component scope so purge authority does not extend to unrelated analytics stores.
Security considerations (3)
- Delete and purge operations are destructive and non-reversible.
- The formal purge completion SLA is 30 days and the operation cannot be expedited, so the status must be tracked as an asynchronous compliance workflow.
- Control-plane classification does not make this role nondestructive; the purge Actions remove matching analytics data.
Assignment guidance
Grant Data Purger only at the Log Analytics workspace or Application Insights resource covered by an approved GDPR request. Verify the query predicate before submission and avoid a parent scope that includes unrelated analytics data.
Related roles (1)
- Log Analytics Contributor: Microsoft documents Log Analytics Contributor as also providing workspace purge permission, while Data Purger isolates the purge function from broader workspace administration.
Common questions
When should I assign the Data Purger Azure role?
Assign Data Purger when you need to: Submit a Log Analytics Purge API request when deletion is required to satisfy a GDPR personal-data request.; and Check the asynchronous purge status after the approved request is submitted.. Practical scope: Assign on the specific Log Analytics workspace or Application Insights resource containing the personal data that must be purged. A resource-group or broader assignment is inherited by every matching analytics resource below that scope.
What permissions does the Data Purger Azure role grant?
The role definition grants 4 combined control-plane and data-plane actions. Representative operations include: Microsoft.Insights/components/*/read; Microsoft.Insights/components/purge/action; Microsoft.OperationalInsights/workspaces/*/read; and Microsoft.OperationalInsights/workspaces/purge/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Data Purger Azure role?
Key considerations when assigning Data Purger: Delete and purge operations are destructive and non-reversible.; The formal purge completion SLA is 30 days and the operation cannot be expedited, so the status must be tracked as an asynchronous compliance workflow.; and Control-plane classification does not make this role nondestructive; the purge Actions remove matching analytics data.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for Monitor →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Manage personal data in Azure Monitor Logs →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.