Azure Internet of Things built-in role
Azure Digital Twins Data Reader
Provides read-only Azure Digital Twins data-plane access to models, twins, relationships, event routes, job state, and graph queries. It has DataActions only and cannot configure the Azure Digital Twins instance or mutate graph data.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: d57506d4-4c8d-48b1-8587-93c323f6a5a3
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (8)
Microsoft.DigitalTwins/digitaltwins/readMicrosoft.DigitalTwins/digitaltwins/relationships/readMicrosoft.DigitalTwins/eventroutes/readMicrosoft.DigitalTwins/jobs/import/readMicrosoft.DigitalTwins/jobs/imports/readMicrosoft.DigitalTwins/jobs/deletions/readMicrosoft.DigitalTwins/models/readMicrosoft.DigitalTwins/query/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual Azure Digital Twins instance. A broader Azure assignment is inherited by other instances, while a custom role can narrow access to selected Digital Twins data areas when the built-in reader is still too broad.
Common use cases (2)
- Let an application, support engineer, or Azure Digital Twins Explorer user query and inspect one twin graph without changing it.
- Authorize a monitoring or reporting workload to read models, twins, relationships, event routes, and job status.
Prerequisites (2)
- An Azure Digital Twins instance and a Microsoft Entra security principal are required, and the client must obtain an OAuth token for the data-plane request.
- If Azure Digital Twins Explorer is used, it cannot reach an instance whose public access is disabled unless the Explorer code is deployed privately.
Best practices (2)
- Use this role instead of Data Owner for query and inspection workloads, and create a custom role when only selected data areas are needed.
- Assign on one instance, use the stable role ID in automation, and use managed identity for an Azure-hosted client.
Security considerations (2)
- Read-only access can expose the entire twin graph, models, relationships, routes, and query results, which may contain operational topology or sensitive state.
- The role does not protect network reachability; combine Azure RBAC with Private Link or other documented network controls when public access is inappropriate.
Assignment guidance
Assign Azure Digital Twins Data Reader directly on the target instance to the application identity or user group that needs graph inspection. Move to Data Owner only for approved mutations, or to a custom role for a smaller data-area boundary.
Related roles (1)
- Azure Digital Twins Data Owner: Adds full write and delete authority across the Azure Digital Twins data plane.
Common questions
When should I assign the Azure Digital Twins Data Reader Azure role?
Assign Azure Digital Twins Data Reader when you need to: Let an application, support engineer, or Azure Digital Twins Explorer user query and inspect one twin graph without changing it.; and Authorize a monitoring or reporting workload to read models, twins, relationships, event routes, and job status.. Practical scope: Assign on the individual Azure Digital Twins instance. A broader Azure assignment is inherited by other instances, while a custom role can narrow access to selected Digital Twins data areas when the built-in reader is still too broad.
What permissions does the Azure Digital Twins Data Reader Azure role grant?
The role definition grants 8 combined control-plane and data-plane actions. Representative operations include: Microsoft.DigitalTwins/digitaltwins/read; Microsoft.DigitalTwins/digitaltwins/relationships/read; Microsoft.DigitalTwins/eventroutes/read; Microsoft.DigitalTwins/jobs/import/read; Microsoft.DigitalTwins/jobs/imports/read; and Microsoft.DigitalTwins/jobs/deletions/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Digital Twins Data Reader Azure role?
Key considerations when assigning Azure Digital Twins Data Reader: Read-only access can expose the entire twin graph, models, relationships, routes, and query results, which may contain operational topology or sensitive state.; and The role does not protect network reachability; combine Azure RBAC with Private Link or other documented network controls when public access is inappropriate.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Internet of Things - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Secure Azure Digital Twins →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.