Azure Integration built-in role
FHIR Data Bulk Operator
Performs FHIR bulk operations through data-plane DataActions. The published role includes FHIR resource reads, writes, deletes, export, reindex, import, hard delete, and bulk-operator operations across supported FHIR service resource paths; it has no control-plane Actions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 804db8d3-32c7-4ad4-a975-3f6f90d5f5f5
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (16)
Microsoft.HealthcareApis/services/fhir/resources/readMicrosoft.HealthcareApis/services/fhir/resources/writeMicrosoft.HealthcareApis/services/fhir/resources/deleteMicrosoft.HealthcareApis/services/fhir/resources/export/actionMicrosoft.HealthcareApis/services/fhir/resources/reindex/actionMicrosoft.HealthcareApis/services/fhir/resources/import/actionMicrosoft.HealthcareApis/services/fhir/resources/hardDelete/actionMicrosoft.HealthcareApis/services/fhir/resources/bulkOperator/actionMicrosoft.HealthcareApis/workspaces/fhirservices/resources/readMicrosoft.HealthcareApis/workspaces/fhirservices/resources/writeMicrosoft.HealthcareApis/workspaces/fhirservices/resources/deleteMicrosoft.HealthcareApis/workspaces/fhirservices/resources/export/actionMicrosoft.HealthcareApis/workspaces/fhirservices/resources/reindex/actionMicrosoft.HealthcareApis/workspaces/fhirservices/resources/import/actionMicrosoft.HealthcareApis/workspaces/fhirservices/resources/hardDelete/actionMicrosoft.HealthcareApis/workspaces/fhirservices/resources/bulkOperator/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual FHIR service instance where bulk operations are approved. For Azure Health Data Services, the scope resource ID includes the workspace and FHIR service; parent assignments inherit the same data access to additional services.
Common use cases (2)
- Run an asynchronous bulk update across selected FHIR resource types after validating the matching search query.
- Perform approved bulk data maintenance that requires the dedicated FHIR bulk-operation authorization boundary.
Prerequisites (3)
- The FHIR service must exist and the operator must authenticate with Microsoft Entra ID.
- Run a FHIR search with the same parameters first, validate the affected resource set, and schedule the operation for an approved maintenance window.
- Confirm backup, versioning, audit-log, and recovery procedures because committed bulk updates are not automatically rolled back.
Best practices (3)
- Assign directly on one FHIR service and reserve this role for controlled bulk maintenance identities.
- Run bulk updates during lower traffic, monitor the polling endpoint and audit logs, and test the exact query and patch in a nonproduction service first.
- Use a narrower FHIR role for ordinary application reads, writes, imports, exports, or conversions.
Security considerations (3)
- Bulk operations can change large volumes of protected health information and can increase latency for concurrent API requests.
- Microsoft warns that committed bulk updates cannot be automatically rolled back; cancellation does not undo already committed changes.
- The published role is broader than one bulk-update action and includes destructive FHIR data operations, including hard delete.
Assignment guidance
Assign FHIR Data Bulk Operator to a dedicated maintenance identity on the specific FHIR service only for approved bulk operations. Require preflight search validation, recovery planning, audit review, and remove the assignment when the maintenance window ends.
Related roles (2)
- FHIR Data Contributor: Microsoft documents Data Contributor as another role able to execute bulk update, while also granting broad FHIR data-plane access.
- FHIR Data Writer: Supports ordinary FHIR reads, writes, soft deletes, and documented writer operations without the dedicated bulk-operator and hard-delete boundary.
Common questions
When should I assign the FHIR Data Bulk Operator Azure role?
Assign FHIR Data Bulk Operator when you need to: Run an asynchronous bulk update across selected FHIR resource types after validating the matching search query.; and Perform approved bulk data maintenance that requires the dedicated FHIR bulk-operation authorization boundary.. Practical scope: Assign on the individual FHIR service instance where bulk operations are approved. For Azure Health Data Services, the scope resource ID includes the workspace and FHIR service; parent assignments inherit the same data access to additional services.
What permissions does the FHIR Data Bulk Operator Azure role grant?
The role definition grants 16 combined control-plane and data-plane actions. Representative operations include: Microsoft.HealthcareApis/services/fhir/resources/read; Microsoft.HealthcareApis/services/fhir/resources/write; Microsoft.HealthcareApis/services/fhir/resources/delete; Microsoft.HealthcareApis/services/fhir/resources/export/action; Microsoft.HealthcareApis/services/fhir/resources/reindex/action; and Microsoft.HealthcareApis/services/fhir/resources/import/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the FHIR Data Bulk Operator Azure role?
Key considerations when assigning FHIR Data Bulk Operator: Bulk operations can change large volumes of protected health information and can increase latency for concurrent API requests.; Microsoft warns that committed bulk updates cannot be automatically rolled back; cancellation does not undo already committed changes.; and The published role is broader than one bulk-update action and includes destructive FHIR data operations, including hard delete.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-17.
- Configure Azure RBAC roles for Azure Health Data Services →
Supports: Practical scope, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Bulk update FHIR resources →
Supports: Description, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.