Azure Integration built-in role

Durable Task Data Contributor

Provides all Durable Task Scheduler data-plane operations and is the documented superset of the other Durable Task roles. It has DataActions only and does not manage the scheduler or task-hub resources through the Azure control plane.

Control-plane actions (0)

None — this role grants no control-plane management actions.

Data-plane actions (1)

• Microsoft.DurableTask/*

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on an individual task hub for one application boundary, or on the scheduler only when the identity needs access to every task hub in that scheduler. Parent Azure scopes inherit the role more broadly.

Common use cases (2)

• Authorize a Durable Functions or Durable Task application that needs the full orchestration, activity, entity, and task-hub data workflow.
• Support an application whose scheduler interactions exceed the execute-only Worker or read-only Data Reader boundaries.

Prerequisites (3)

• A Durable Task Scheduler and task hub must already be provisioned.
• The Function App or Container App must have a system-assigned or user-assigned managed identity; Durable Task Scheduler supports managed-identity authentication only.
• The application must be configured with the scheduler endpoint, task-hub name, and managed-identity connection settings.

Best practices (3)

• Use task-hub scope instead of scheduler scope unless the identity must access all task hubs.
• Prefer a user-assigned managed identity because it is independent of the application lifecycle and can be reused after the app is deprovisioned.
• Use Durable Task Worker for an app that only processes orchestrations, activities, and entities, or Data Reader for observation-only access.

Security considerations (3)

• The role grants every published Durable Task data operation and can affect orchestration, activity, entity, and task-hub state throughout its scope.
• Scheduler scope extends the same complete data access to every task hub in the scheduler.
• The role does not create, delete, or configure scheduler and task-hub Azure resources through the control plane.

Assignment guidance

Assign Durable Task Data Contributor to the application managed identity on the specific task hub. Use scheduler scope only for a documented multi-hub workload, and select Worker or Data Reader when those narrower workflows are sufficient.

Related roles (2)

• Durable Task Worker: Limits a worker application to processing orchestrations, activities, and entities.
• Durable Task Data Reader: Limits access to reading orchestration and entity data.

Editorial sources (6)

• Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Configure managed identity for Durable Task Scheduler →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →