Azure Integration built-in role
Durable Task Data Reader
Provides read-only access to Durable Task Scheduler orchestration and entity data. The role contains DataActions only and does not process work or manage scheduler and task-hub Azure resources.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: d6a5505f-6ebb-45a4-896e-ac8274cfc0ac
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (2)
Microsoft.DurableTask/schedulers/taskhubs/orchestrations/readMicrosoft.DurableTask/schedulers/taskhubs/orchestrations/metadata/read
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual task hub whose orchestration data the identity may inspect. Scheduler scope exposes data from every task hub in that scheduler and should be used only for a scheduler-wide reader.
Common use cases (2)
- Let a diagnostics or support identity list orchestrations and read entity payloads without processing work.
- Provide application-specific observation of one task hub without full data contribution rights.
Prerequisites (2)
- The Durable Task Scheduler and task hub to observe must already exist.
- The observing application must use a managed identity because Durable Task Scheduler does not support storage-key connection strings.
Best practices (2)
- Assign at task-hub scope and use a user-assigned managed identity for a reusable monitoring application.
- Use Worker for a processing application or Data Contributor only when complete Durable Task data operations are required.
Security considerations (2)
- Orchestration metadata and entity payloads can reveal workflow state and application data even though the role cannot process or change it.
- A scheduler-scope assignment exposes orchestration data across all task hubs in that scheduler.
Assignment guidance
Assign Durable Task Data Reader to the monitoring or diagnostics identity on the specific task hub. Broaden to scheduler scope only for an approved cross-hub monitoring service.
Related roles (2)
- Durable Task Data Contributor: Adds all Durable Task data operations and is the documented superset of Data Reader.
- Durable Task Worker: Processes orchestrations, activities, and entities rather than providing a general read-only view.
Editorial sources (6)
- Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Configure managed identity for Durable Task Scheduler →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.