Azure Internet of Things built-in role
Azure Device Registry Contributor
Manages devices and discovered devices in an Azure Device Registry namespace, reads namespace credential policy metadata, can issue certificates under a policy, and accesses linked IoT Hub device operations. It combines control-plane Actions with certificate-issuance and IoT Hub device DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: a5c3590a-3a1a-4cd4-9648-ea0a32b15137
Control-plane actions (7)
microsoft.deviceregistry/namespaces/readmicrosoft.deviceregistry/namespaces/devices/*microsoft.deviceregistry/namespaces/discovereddevices/*microsoft.deviceregistry/namespaces/credentials/readmicrosoft.deviceregistry/namespaces/credentials/policies/readmicrosoft.devices/iothubs/certificates/*microsoft.devices/iothubs/read
Data-plane actions (2)
microsoft.deviceregistry/namespaces/credentials/policies/issueCertificate/actionmicrosoft.devices/iothubs/devices/*
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Microsoft documents assignment to the user-assigned managed identity on the individual Device Registry namespace. A parent assignment is inherited by other namespaces and linked device resources, so namespace scope is the practical boundary.
Common use cases (2)
- Give the managed identity used by an IoT Hub and Device Registry integration full access to devices in the target Device Registry namespace.
- Operate the documented preview workflow that synchronizes IoT Hub device identities with Azure Device Registry and issues Microsoft-backed X.509 device certificates.
Prerequisites (2)
- The IoT Hub, Device Registry namespace, and optional Device Provisioning Service instance must be deployed in a supported region, and the documented integration is in public preview.
- A user-assigned managed identity must exist for the integration, and the assigning principal needs roleAssignments/write at the namespace scope.
Best practices (2)
- Assign to the integration managed identity directly on one namespace and do not use this broad role for a principal that only manages credential policies.
- Treat the Device Registry and certificate-management integration as preview functionality and validate device enrollment, certificate issuance, and revocation before production use.
Security considerations (2)
- The role can mutate registry devices, access linked IoT Hub device identities, issue certificates under credential policies, and read certificate configuration.
- A parent-scope assignment extends device and certificate authority across inherited namespaces; the preview integration is not recommended for production workloads.
Assignment guidance
Assign Azure Device Registry Contributor to the documented user-assigned managed identity on the target namespace for the IoT Hub integration. Use Credentials Contributor only for a separately documented credential-policy workflow, and reserve the Administrator wildcard for cases Microsoft explicitly documents.
Related roles (2)
- Azure Device Registry Onboarding: Provisions the namespace, linked IoT Hub and DPS resources, and X.509 enrollment configuration used before routine device operations.
- Azure Device Registry Credentials Contributor: Restricts the published role definition to credential, policy, and device-revocation management rather than general device operations.
Common questions
When should I assign the Azure Device Registry Contributor Azure role?
Assign Azure Device Registry Contributor when you need to: Give the managed identity used by an IoT Hub and Device Registry integration full access to devices in the target Device Registry namespace.; and Operate the documented preview workflow that synchronizes IoT Hub device identities with Azure Device Registry and issues Microsoft-backed X.509 device certificates.. Practical scope: Microsoft documents assignment to the user-assigned managed identity on the individual Device Registry namespace. A parent assignment is inherited by other namespaces and linked device resources, so namespace scope is the practical boundary.
What permissions does the Azure Device Registry Contributor Azure role grant?
The role definition grants 9 combined control-plane and data-plane actions. Representative operations include: microsoft.deviceregistry/namespaces/read; microsoft.deviceregistry/namespaces/devices/*; microsoft.deviceregistry/namespaces/discovereddevices/*; microsoft.deviceregistry/namespaces/credentials/read; microsoft.deviceregistry/namespaces/credentials/policies/read; and microsoft.devices/iothubs/certificates/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Device Registry Contributor Azure role?
Key considerations when assigning Azure Device Registry Contributor: The role can mutate registry devices, access linked IoT Hub device identities, issue certificates under credential policies, and read certificate configuration.; and A parent-scope assignment extends device and certificate authority across inherited namespaces; the preview integration is not recommended for production workloads.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Internet of Things - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Deploy Azure IoT Hub with Device Registry integration and certificate management (preview) →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.