Azure Integration built-in role
Durable Task Worker
Authorizes a worker application to interact with Durable Task Scheduler for processing orchestrations, activities, and entities. It is a data-plane role with no control-plane Actions and is narrower than Data Contributor.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 80d0d6b0-f522-40a4-8886-a5a11720c375
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (1)
Microsoft.DurableTask/schedulers/taskhubs/orchestrations/execute/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the task hub processed by the worker. Use scheduler scope only when the same worker identity intentionally processes work from every task hub in that scheduler.
Common use cases (2)
- Authorize a worker application used only to process orchestrations, activities, and entities in one task hub.
- Separate runtime work processing from full Durable Task data administration and read-only diagnostics.
Prerequisites (2)
- A Durable Task Scheduler and target task hub must already exist.
- The worker application must use an attached system-assigned or user-assigned managed identity and the documented scheduler connection settings.
Best practices (2)
- Use this role instead of Data Contributor when the application only processes Durable Task work.
- Assign on one task hub and prefer a user-assigned managed identity so identity lifecycle is independent of the app.
Security considerations (2)
- The role lets the workload execute orchestration processing, which can trigger application activities and side effects defined by the workflow.
- It does not grant all Durable Task data operations or Azure resource management, but scheduler scope extends processing authority across every task hub.
Assignment guidance
Assign Durable Task Worker to the worker application managed identity on the specific task hub it processes. Use Data Contributor only when the app needs additional data operations and Data Reader for monitoring identities.
Related roles (2)
- Durable Task Data Contributor: The documented superset for applications that require all Durable Task data operations.
- Durable Task Data Reader: Reads orchestration and entity data without processing work.
Common questions
When should I assign the Durable Task Worker Azure role?
Assign Durable Task Worker when you need to: Authorize a worker application used only to process orchestrations, activities, and entities in one task hub.; and Separate runtime work processing from full Durable Task data administration and read-only diagnostics.. Practical scope: Assign on the task hub processed by the worker. Use scheduler scope only when the same worker identity intentionally processes work from every task hub in that scheduler.
What permissions does the Durable Task Worker Azure role grant?
The role definition grants 1 combined control-plane and data-plane actions. Representative operations include: Microsoft.DurableTask/schedulers/taskhubs/orchestrations/execute/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Durable Task Worker Azure role?
Key considerations when assigning Durable Task Worker: The role lets the workload execute orchestration processing, which can trigger application activities and side effects defined by the workflow.; and It does not grant all Durable Task data operations or Azure resource management, but scheduler scope extends processing authority across every task hub.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Configure managed identity for Durable Task Scheduler →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.