Azure Integration built-in role
DICOM Data Reader
Reads and searches DICOM data through the Azure Health Data Services data plane. It has DataActions only and cannot write or delete imaging data or manage the DICOM service resource.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: e89c7a3c-2f64-4fa1-a847-3e4c9ba4283a
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (1)
Microsoft.HealthcareApis/workspaces/dicomservices/resources/read
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual DICOM service instance whose imaging data the principal may search and retrieve. Parent assignments inherit visibility to additional DICOM services below their scope.
Common use cases (2)
- Authorize a clinical viewer or analytics application to search and retrieve imaging data without modifying it.
- Give a reviewer read-only access to DICOM data in one Health Data Services workspace service.
Prerequisites (2)
- The DICOM service and client application registration must exist.
- For a user-delegated client flow, add the delegated `Dicom.ReadWrite` API scope that the client requests on behalf of the signed-in user. This API scope is separate from the Azure RBAC role assignment and is not an app-only application permission.
Best practices (2)
- Assign directly on one DICOM service and use Data Owner only for approved ingestion or data-management workflows.
- Use dedicated application identities, protect tokens and retrieved medical images, and configure `Dicom.ReadWrite` only for client flows that act on behalf of a user.
Security considerations (4)
- Read and search access exposes medical imaging data and associated metadata that can contain protected health information.
- DICOM access decisions can be cached for up to five minutes after assignment changes.
- Azure RBAC and the delegated `Dicom.ReadWrite` client scope are separate authorization layers; the delegated scope is requested on behalf of a signed-in user and is not an app-only permission.
- The role cannot write or delete DICOM data and does not manage the Azure resource.
Assignment guidance
Assign DICOM Data Reader to the viewer or analytics principal directly on the DICOM service. For a client acting for a signed-in user, configure delegated `Dicom.ReadWrite` separately in the app registration. Elevate the Azure RBAC assignment to Data Owner only for a documented write or delete workflow.
Related roles (1)
- DICOM Data Owner: Adds full DICOM data write and delete access.
Common questions
When should I assign the DICOM Data Reader Azure role?
Assign DICOM Data Reader when you need to: Authorize a clinical viewer or analytics application to search and retrieve imaging data without modifying it.; and Give a reviewer read-only access to DICOM data in one Health Data Services workspace service.. Practical scope: Assign on the individual DICOM service instance whose imaging data the principal may search and retrieve. Parent assignments inherit visibility to additional DICOM services below their scope.
What permissions does the DICOM Data Reader Azure role grant?
The role definition grants 1 combined control-plane and data-plane actions. Representative operations include: Microsoft.HealthcareApis/workspaces/dicomservices/resources/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the DICOM Data Reader Azure role?
Key considerations when assigning DICOM Data Reader: Read and search access exposes medical imaging data and associated metadata that can contain protected health information.; DICOM access decisions can be cached for up to five minutes after assignment changes.; Azure RBAC and the delegated `Dicom.ReadWrite` client scope are separate authorization layers; the delegated scope is requested on behalf of a signed-in user and is not an app-only permission.; and The role cannot write or delete DICOM data and does not manage the Azure resource.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (8)
- Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-17.
- Configure Azure RBAC roles for Azure Health Data Services →
Supports: Description, Practical scope, Prerequisites, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Configure Azure RBAC for the DICOM service →
Supports: Description, Common use cases, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Register a client application for the DICOM service →
Supports: Prerequisites, Security considerations, Assignment guidance. Retrieved 2026-07-17.