Azure Integration built-in role
DICOM Data Owner
Provides full data-plane access to DICOM data in Azure Health Data Services. It has DataActions only and does not manage the DICOM service or Health Data Services workspace through the Azure control plane.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 58a3b984-7adf-4c20-983a-32417c86fbc8
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (1)
Microsoft.HealthcareApis/workspaces/dicomservices/resources/*
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual DICOM service instance whose imaging data the principal manages. For Azure Health Data Services, the service-instance resource ID includes the workspace and DICOM service name; parent assignments inherit access more broadly.
Common use cases (2)
- Authorize a trusted imaging application to store, retrieve, search, update, and delete DICOM data in one service.
- Give an imaging data administrator full DICOM data-plane access without Azure resource lifecycle authority.
Prerequisites (2)
- The DICOM service and client application registration must exist.
- For a user-delegated client flow, add the delegated `Dicom.ReadWrite` API scope that the client requests on behalf of the signed-in user. This API scope is separate from the Azure RBAC role assignment and is not an app-only application permission.
Best practices (2)
- Assign on the individual DICOM service and use DICOM Data Reader for applications that only search and retrieve images.
- Use separate identities for ingestion, clinical viewing, and administration where their data duties differ, and configure `Dicom.ReadWrite` only for client flows that act on behalf of a user.
Security considerations (3)
- The role can read, write, and delete medical imaging data, which can contain protected health information.
- DICOM access decisions can be cached for up to five minutes after an assignment is added or removed.
- Azure RBAC authorizes the assigned user, group, or service principal at the DICOM service. In a delegated user flow, the client registration separately requests `Dicom.ReadWrite` on behalf of that user; the delegated scope must not be described as app-only authority.
Assignment guidance
Assign DICOM Data Owner to the trusted imaging administrator or ingestion identity directly on the DICOM service. For a client acting for a signed-in user, configure delegated `Dicom.ReadWrite` separately in the app registration. Use DICOM Data Reader for Azure RBAC principals that need only search and retrieval.
Related roles (1)
- DICOM Data Reader: Limits DICOM data access to read and search operations.
Common questions
When should I assign the DICOM Data Owner Azure role?
Assign DICOM Data Owner when you need to: Authorize a trusted imaging application to store, retrieve, search, update, and delete DICOM data in one service.; and Give an imaging data administrator full DICOM data-plane access without Azure resource lifecycle authority.. Practical scope: Assign on the individual DICOM service instance whose imaging data the principal manages. For Azure Health Data Services, the service-instance resource ID includes the workspace and DICOM service name; parent assignments inherit access more broadly.
What permissions does the DICOM Data Owner Azure role grant?
The role definition grants 1 combined control-plane and data-plane actions. Representative operations include: Microsoft.HealthcareApis/workspaces/dicomservices/resources/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the DICOM Data Owner Azure role?
Key considerations when assigning DICOM Data Owner: The role can read, write, and delete medical imaging data, which can contain protected health information.; DICOM access decisions can be cached for up to five minutes after an assignment is added or removed.; and Azure RBAC authorizes the assigned user, group, or service principal at the DICOM service. In a delegated user flow, the client registration separately requests `Dicom.ReadWrite` on behalf of that user; the delegated scope must not be described as app-only authority.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (8)
- Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-17.
- Configure Azure RBAC roles for Azure Health Data Services →
Supports: Description, Practical scope, Prerequisites, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Configure Azure RBAC for the DICOM service →
Supports: Description, Common use cases, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Register a client application for the DICOM service →
Supports: Prerequisites, Security considerations, Assignment guidance. Retrieved 2026-07-17.