Azure Internet of Things built-in role
Device Provisioning Service Data Contributor
Device Provisioning Service Data Contributor provides full read, create, update, and delete access to Device Provisioning Service APIs through DataActions only. It does not manage the DPS Azure resource through the control plane and does not authenticate device registration APIs.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: dfce44e4-17b7-4bd1-a6d1-04996ec95633
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (1)
Microsoft.Devices/provisioningServices/*
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual Device Provisioning Service instance. Azure RBAC does not support enrollment-group or individual-enrollment assignment scope, and broader assignments are inherited by every DPS instance below them.
Common use cases (2)
- Let an approved provisioning operator or service client create, update, or delete enrollments and enrollment groups and manage registration state through Microsoft Entra-authenticated DPS service APIs.
- Use Azure CLI or an SDK service client with Microsoft Entra authentication for a DPS administrative workflow during the documented preview.
Prerequisites (2)
- An existing DPS instance and a Microsoft Entra user, group, application service principal, or managed identity are required; the client requests a token for https://azure-devices-provisioning.net.
- The Microsoft Entra DPS authorization experience is in preview, is unavailable in the Azure portal, and does not replace symmetric key, X.509, or TPM authentication for device registration APIs.
Best practices (2)
- Use Data Reader when enrollment mutation is unnecessary, and use a custom role when the client requires fewer DPS operations.
- Assign directly on one DPS instance and test the supported CLI or SDK path because Microsoft Entra portal access is unavailable during preview.
Security considerations (2)
- The role can change or delete enrollments and enrollment groups, retrieve attestation details, and delete registration state, affecting which devices can provision and how they authenticate.
- Microsoft Entra authorization for DPS is preview functionality and does not authorize the device-facing register-device or registration-status APIs.
Assignment guidance
Assign Device Provisioning Service Data Contributor on the target DPS instance to the Microsoft Entra principal that calls the supported service APIs. Keep device attestation separate, avoid parent-scope assignments, and use the companion role or a custom role when the required operation set differs.
Related roles (1)
- Device Provisioning Service Data Reader: Provides read-only DPS service-API access without enrollment or registration-state mutation.
Common questions
When should I assign the Device Provisioning Service Data Contributor Azure role?
Assign Device Provisioning Service Data Contributor when you need to: Let an approved provisioning operator or service client create, update, or delete enrollments and enrollment groups and manage registration state through Microsoft Entra-authenticated DPS service APIs.; and Use Azure CLI or an SDK service client with Microsoft Entra authentication for a DPS administrative workflow during the documented preview.. Practical scope: Assign on the individual Device Provisioning Service instance. Azure RBAC does not support enrollment-group or individual-enrollment assignment scope, and broader assignments are inherited by every DPS instance below them.
What permissions does the Device Provisioning Service Data Contributor Azure role grant?
The role definition grants 1 combined control-plane and data-plane actions. Representative operations include: Microsoft.Devices/provisioningServices/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Device Provisioning Service Data Contributor Azure role?
Key considerations when assigning Device Provisioning Service Data Contributor: The role can change or delete enrollments and enrollment groups, retrieve attestation details, and delete registration state, affecting which devices can provision and how they authenticate.; and Microsoft Entra authorization for DPS is preview functionality and does not authorize the device-facing register-device or registration-status APIs.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Internet of Things - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Control access to Azure IoT Hub Device Provisioning Service (DPS) by using Microsoft Entra ID (preview) →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.