Azure Integration built-in role
Durable Task Data Reader
Provides read-only access to Durable Task Scheduler orchestration and entity data. The role contains DataActions only and does not process work or manage scheduler and task-hub Azure resources.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: d6a5505f-6ebb-45a4-896e-ac8274cfc0ac
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (2)
Microsoft.DurableTask/schedulers/taskhubs/orchestrations/readMicrosoft.DurableTask/schedulers/taskhubs/orchestrations/metadata/read
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual task hub whose orchestration data the identity may inspect. Scheduler scope exposes data from every task hub in that scheduler and should be used only for a scheduler-wide reader.
Common use cases (2)
- Let a diagnostics or support identity list orchestrations and read entity payloads without processing work.
- Provide application-specific observation of one task hub without full data contribution rights.
Prerequisites (2)
- The Durable Task Scheduler and task hub to observe must already exist.
- The observing application must use a managed identity because Durable Task Scheduler does not support storage-key connection strings.
Best practices (2)
- Assign at task-hub scope and use a user-assigned managed identity for a reusable monitoring application.
- Use Worker for a processing application or Data Contributor only when complete Durable Task data operations are required.
Security considerations (2)
- Orchestration metadata and entity payloads can reveal workflow state and application data even though the role cannot process or change it.
- A scheduler-scope assignment exposes orchestration data across all task hubs in that scheduler.
Assignment guidance
Assign Durable Task Data Reader to the monitoring or diagnostics identity on the specific task hub. Broaden to scheduler scope only for an approved cross-hub monitoring service.
Related roles (2)
- Durable Task Data Contributor: Adds all Durable Task data operations and is the documented superset of Data Reader.
- Durable Task Worker: Processes orchestrations, activities, and entities rather than providing a general read-only view.
Common questions
When should I assign the Durable Task Data Reader Azure role?
Assign Durable Task Data Reader when you need to: Let a diagnostics or support identity list orchestrations and read entity payloads without processing work.; and Provide application-specific observation of one task hub without full data contribution rights.. Practical scope: Assign on the individual task hub whose orchestration data the identity may inspect. Scheduler scope exposes data from every task hub in that scheduler and should be used only for a scheduler-wide reader.
What permissions does the Durable Task Data Reader Azure role grant?
The role definition grants 2 combined control-plane and data-plane actions. Representative operations include: Microsoft.DurableTask/schedulers/taskhubs/orchestrations/read; and Microsoft.DurableTask/schedulers/taskhubs/orchestrations/metadata/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Durable Task Data Reader Azure role?
Key considerations when assigning Durable Task Data Reader: Orchestration metadata and entity payloads can reveal workflow state and application data even though the role cannot process or change it.; and A scheduler-scope assignment exposes orchestration data across all task hubs in that scheduler.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Configure managed identity for Durable Task Scheduler →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.