Azure Integration built-in role
Durable Task Data Contributor
Provides all Durable Task Scheduler data-plane operations and is the documented superset of the other Durable Task roles. It has DataActions only and does not manage the scheduler or task-hub resources through the Azure control plane.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 0ad04412-c4d5-4796-b79c-f76d14c8d402
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (1)
Microsoft.DurableTask/*
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on an individual task hub for one application boundary, or on the scheduler only when the identity needs access to every task hub in that scheduler. Parent Azure scopes inherit the role more broadly.
Common use cases (2)
- Authorize a Durable Functions or Durable Task application that needs the full orchestration, activity, entity, and task-hub data workflow.
- Support an application whose scheduler interactions exceed the execute-only Worker or read-only Data Reader boundaries.
Prerequisites (3)
- A Durable Task Scheduler and task hub must already be provisioned.
- The Function App or Container App must have a system-assigned or user-assigned managed identity; Durable Task Scheduler supports managed-identity authentication only.
- The application must be configured with the scheduler endpoint, task-hub name, and managed-identity connection settings.
Best practices (3)
- Use task-hub scope instead of scheduler scope unless the identity must access all task hubs.
- Prefer a user-assigned managed identity because it is independent of the application lifecycle and can be reused after the app is deprovisioned.
- Use Durable Task Worker for an app that only processes orchestrations, activities, and entities, or Data Reader for observation-only access.
Security considerations (3)
- The role grants every published Durable Task data operation and can affect orchestration, activity, entity, and task-hub state throughout its scope.
- Scheduler scope extends the same complete data access to every task hub in the scheduler.
- The role does not create, delete, or configure scheduler and task-hub Azure resources through the control plane.
Assignment guidance
Assign Durable Task Data Contributor to the application managed identity on the specific task hub. Use scheduler scope only for a documented multi-hub workload, and select Worker or Data Reader when those narrower workflows are sufficient.
Related roles (2)
- Durable Task Worker: Limits a worker application to processing orchestrations, activities, and entities.
- Durable Task Data Reader: Limits access to reading orchestration and entity data.
Common questions
When should I assign the Durable Task Data Contributor Azure role?
Assign Durable Task Data Contributor when you need to: Authorize a Durable Functions or Durable Task application that needs the full orchestration, activity, entity, and task-hub data workflow.; and Support an application whose scheduler interactions exceed the execute-only Worker or read-only Data Reader boundaries.. Practical scope: Assign on an individual task hub for one application boundary, or on the scheduler only when the identity needs access to every task hub in that scheduler. Parent Azure scopes inherit the role more broadly.
What permissions does the Durable Task Data Contributor Azure role grant?
The role definition grants 1 combined control-plane and data-plane actions. Representative operations include: Microsoft.DurableTask/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Durable Task Data Contributor Azure role?
Key considerations when assigning Durable Task Data Contributor: The role grants every published Durable Task data operation and can affect orchestration, activity, entity, and task-hub state throughout its scope.; Scheduler scope extends the same complete data access to every task hub in the scheduler.; and The role does not create, delete, or configure scheduler and task-hub Azure resources through the control plane.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Configure managed identity for Durable Task Scheduler →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.