Azure Internet of Things built-in role
Azure Digital Twins Data Owner
Provides full Azure Digital Twins data-plane access to models, twins, relationships, commands, event routes, jobs, and graph queries. It contains DataActions only and does not manage the Azure Digital Twins instance through the Azure control plane.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: bcd981a7-7f74-457b-83e1-cceb9e632ffe
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (7)
Microsoft.DigitalTwins/digitaltwins/*Microsoft.DigitalTwins/digitaltwins/commands/*Microsoft.DigitalTwins/digitaltwins/relationships/*Microsoft.DigitalTwins/eventroutes/*Microsoft.DigitalTwins/jobs/*Microsoft.DigitalTwins/models/*Microsoft.DigitalTwins/query/*
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual Azure Digital Twins instance. For a principal that needs only selected models, twins, relationships, routes, jobs, or query operations, Microsoft documents creating a custom role rather than broadening this built-in owner.
Common use cases (2)
- Operate an Azure Digital Twins solution that must create and change models, twins, relationships, event routes, imports, deletions, and graph queries.
- Authorize a managed identity or application service principal that performs the complete data-plane lifecycle for one Digital Twins instance.
Prerequisites (2)
- An Azure Digital Twins instance and a Microsoft Entra user, group, application service principal, or managed identity are required.
- The assigning principal needs permission to create role assignments; Azure resource Owner is distinct and does not itself grant Digital Twins data-plane access.
Best practices (2)
- Use Data Reader for query and inspection workflows and create a custom role when the application needs mutation access to only selected data areas.
- Assign directly on one instance, refer to the stable role definition ID in automation, and use managed identity for Azure-hosted client applications.
Security considerations (2)
- The role can alter or delete the twin graph, models, relationships, routes, and jobs and can query all data exposed by the instance.
- Azure resource Owner and Azure Digital Twins Data Owner are separate control-plane and data-plane roles; granting both combines infrastructure and graph authority.
Assignment guidance
Assign Azure Digital Twins Data Owner on the individual instance only to the operator or workload identity that must mutate the full data plane. Use Data Reader or a custom role for query-only or data-area-specific access, and manage the Azure resource with a separate control-plane role.
Related roles (1)
- Azure Digital Twins Data Reader: Provides read-only access to Digital Twins models, graph data, relationships, routes, job state, and queries.
Editorial sources (6)
- Azure built-in roles for Internet of Things - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Secure Azure Digital Twins →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.