Azure Internet of Things built-in role
Device Update Administrator
Device Update Administrator provides all content and deployment operations in Device Update for IoT Hub. Its definition combines Azure control-plane reads with Device Update data-plane operations; it does not by itself grant the Device Update service principal access to the linked IoT hub.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 02ca0879-e8e4-47a5-a61e-5c618b76e64a
Control-plane actions (6)
Microsoft.Authorization/*/readMicrosoft.Resources/subscriptions/resourceGroups/readMicrosoft.Support/*Microsoft.Insights/alertRules/*Microsoft.DeviceUpdate/accounts/readMicrosoft.DeviceUpdate/accounts/instances/read
Data-plane actions (6)
Microsoft.DeviceUpdate/accounts/instances/updates/readMicrosoft.DeviceUpdate/accounts/instances/updates/writeMicrosoft.DeviceUpdate/accounts/instances/updates/deleteMicrosoft.DeviceUpdate/accounts/instances/management/readMicrosoft.DeviceUpdate/accounts/instances/management/writeMicrosoft.DeviceUpdate/accounts/instances/management/delete
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign through Access control (IAM) on the Device Update account and its instance. A parent resource-group or subscription assignment is inherited by other Device Update resources and is broader than the documented account-level workflow.
Common use cases (1)
- Operate the complete Device Update workflow, including importing and deleting update content and creating, monitoring, canceling, or retrying deployments.
Prerequisites (2)
- A Device Update account and instance must be configured with an IoT hub, and the user, group, application, service principal, or managed identity must be identified.
- The Device Update service principal separately needs IoT Hub Data Contributor on the linked hub so the service can create, cancel, and retry deployments and retrieve device information.
Best practices (2)
- Separate content administration from deployment administration when one principal does not need both capabilities, and combine a content role with a deployment reader only when progress visibility is required.
- Use system-assigned managed identities for service integrations where supported and assign the role directly on the Device Update account rather than a parent scope.
Security considerations (2)
- The role can change both the update artifacts offered to devices and the deployments that deliver them, combining content supply-chain and fleet rollout authority.
- Device Update access and the linked IoT Hub service-principal assignment are separate trust boundaries; removing or overgranting either assignment changes the end-to-end update workflow.
Assignment guidance
Assign Device Update Administrator on the Device Update account to the operator or application that needs all content and deployment operations. Add only the complementary content or deployment role required by the workflow, and configure the service principal's IoT Hub Data Contributor assignment separately on the linked hub.
Related roles (3)
- Device Update Content Administrator: Separates update content management from deployment management.
- Device Update Deployments Administrator: Separates fleet deployment management from content mutation.
- Device Update Reader: Provides combined read-only visibility across content and deployments.
Common questions
When should I assign the Device Update Administrator Azure role?
Assign Device Update Administrator when you need to: Operate the complete Device Update workflow, including importing and deleting update content and creating, monitoring, canceling, or retrying deployments.. Practical scope: Assign through Access control (IAM) on the Device Update account and its instance. A parent resource-group or subscription assignment is inherited by other Device Update resources and is broader than the documented account-level workflow.
What permissions does the Device Update Administrator Azure role grant?
The role definition grants 12 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Resources/subscriptions/resourceGroups/read; Microsoft.Support/*; Microsoft.Insights/alertRules/*; Microsoft.DeviceUpdate/accounts/read; and Microsoft.DeviceUpdate/accounts/instances/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Device Update Administrator Azure role?
Key considerations when assigning Device Update Administrator: The role can change both the update artifacts offered to devices and the deployments that deliver them, combining content supply-chain and fleet rollout authority.; and Device Update access and the linked IoT Hub service-principal assignment are separate trust boundaries; removing or overgranting either assignment changes the end-to-end update workflow.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Internet of Things - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Azure RBAC and Azure Device Update for IoT Hub →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Configure access control for Device Update resources →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.