Azure Integration built-in role
FHIR Data Importer
Reads FHIR data and starts the high-throughput `$import` data-plane operation for Azure Health Data Services workspace FHIR services. It has no control-plane Actions and does not apply to the legacy standalone Azure API for FHIR resource path.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 4465e953-8ced-4406-a58e-0f6e3f3b530b
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (2)
Microsoft.HealthcareApis/workspaces/fhirservices/resources/readMicrosoft.HealthcareApis/workspaces/fhirservices/resources/import/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual Azure Health Data Services FHIR service that receives the import. Parent-scope assignments inherit import authority to additional workspace FHIR services.
Common use cases (2)
- Perform an initial high-throughput load of FHIR NDJSON resources into an empty FHIR service.
- Run incremental or near-real-time NDJSON ingestion while preserving supported resource history metadata.
Prerequisites (3)
- Store valid resource-specific FHIR NDJSON files in Azure Blob Storage in the same tenant as the FHIR service and configure import settings.
- Grant Storage Blob Data Contributor to the FHIR service managed identity on the input storage boundary.
- Choose initial or incremental mode deliberately; initial mode blocks concurrent API writes.
Best practices (3)
- Assign directly on one FHIR service and use a dedicated import workload identity.
- Use new file names or ETags instead of updating import files in place, limit parallel jobs, and validate results and error files after every import.
- Use incremental mode when preserving version history or allowing concurrent writes is required.
Security considerations (3)
- Import can add large volumes of protected health information and can preserve historical or soft-deleted resources.
- Initial mode blocks write API calls, while incremental imports can run concurrently with CRUD operations and incur per-resource charges.
- Successfully imported resources are not rolled back when part of a job fails; input and error storage both require protection.
Assignment guidance
Assign FHIR Data Importer to the ingestion identity on the specific workspace FHIR service. Grant the FHIR service identity narrowly scoped Blob access, choose the import mode explicitly, and monitor callback and error outputs before removing the assignment.
Related roles (3)
- FHIR Data Writer: Supports ordinary FHIR write workflows rather than the dedicated high-throughput import boundary.
- FHIR Data Contributor: Provides broad FHIR data-plane access beyond import.
- Storage Blob Data Contributor: The documented separate storage role for the FHIR service managed identity to read import files and write errors.
Editorial sources (7)
- Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-17.
- Configure Azure RBAC roles for Azure Health Data Services →
Supports: Practical scope, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Import data into the FHIR service →
Supports: Description, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.