Azure Integration built-in role
FHIR Data Exporter
Reads FHIR data and starts the bulk `$export` data-plane operation. It has no control-plane Actions; the FHIR service writes exported NDJSON files to a separately configured Data Lake Storage Gen2 account.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 3db33094-8700-4567-8da5-1501d4e7e843
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (4)
Microsoft.HealthcareApis/services/fhir/resources/readMicrosoft.HealthcareApis/services/fhir/resources/export/actionMicrosoft.HealthcareApis/workspaces/fhirservices/resources/readMicrosoft.HealthcareApis/workspaces/fhirservices/resources/export/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual FHIR service whose data may be exported. Parent-scope assignments extend bulk-read and export authority to additional inherited FHIR services.
Common use cases (2)
- Export system, patient, or group FHIR data as NDJSON for an approved analytics, archival, or migration workflow.
- Run incremental exports using supported filters after the destination storage boundary is configured.
Prerequisites (2)
- Configure the FHIR service to connect to a Data Lake Storage Gen2 account in the same subscription and create or identify the destination container.
- Authorize the FHIR service identity to write to the destination storage and require the documented asynchronous request headers.
Best practices (3)
- Assign directly on one FHIR service and tightly scope the service identity on the export storage account.
- Use `_since`, `_type`, and other supported filters to export only the approved data set, monitor the Content-Location status URL, and protect every generated NDJSON folder.
- Do not use Data Contributor when the workload only reads and exports FHIR data.
Security considerations (3)
- The role can bulk-extract protected health information from the FHIR repository into Azure Storage.
- Patient and group exports can contain duplicate resources, and history or soft-deleted-resource options can expand the exported data set.
- Storage permissions and network configuration determine who can access the exported files after the FHIR service writes them.
Assignment guidance
Assign FHIR Data Exporter to the export workload identity on the specific FHIR service. Configure a dedicated same-subscription storage destination, narrowly authorize the FHIR service identity there, and remove export access when the approved transfer is complete.
Related roles (2)
- FHIR Data Reader: Reads and searches FHIR data without the bulk export operation.
- FHIR Data Contributor: Provides broad FHIR data-plane administration and is wider than a read-and-export workflow.
Common questions
When should I assign the FHIR Data Exporter Azure role?
Assign FHIR Data Exporter when you need to: Export system, patient, or group FHIR data as NDJSON for an approved analytics, archival, or migration workflow.; and Run incremental exports using supported filters after the destination storage boundary is configured.. Practical scope: Assign on the individual FHIR service whose data may be exported. Parent-scope assignments extend bulk-read and export authority to additional inherited FHIR services.
What permissions does the FHIR Data Exporter Azure role grant?
The role definition grants 4 combined control-plane and data-plane actions. Representative operations include: Microsoft.HealthcareApis/services/fhir/resources/read; Microsoft.HealthcareApis/services/fhir/resources/export/action; Microsoft.HealthcareApis/workspaces/fhirservices/resources/read; and Microsoft.HealthcareApis/workspaces/fhirservices/resources/export/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the FHIR Data Exporter Azure role?
Key considerations when assigning FHIR Data Exporter: The role can bulk-extract protected health information from the FHIR repository into Azure Storage.; Patient and group exports can contain duplicate resources, and history or soft-deleted-resource options can expand the exported data set.; and Storage permissions and network configuration determine who can access the exported files after the FHIR service writes them.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-17.
- Configure Azure RBAC roles for Azure Health Data Services →
Supports: Description, Practical scope, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Export your FHIR data →
Supports: Description, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.