Azure Integration built-in role
FHIR Data Importer
Reads FHIR data and starts the high-throughput `$import` data-plane operation for Azure Health Data Services workspace FHIR services. It has no control-plane Actions and does not apply to the legacy standalone Azure API for FHIR resource path.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 4465e953-8ced-4406-a58e-0f6e3f3b530b
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (2)
Microsoft.HealthcareApis/workspaces/fhirservices/resources/readMicrosoft.HealthcareApis/workspaces/fhirservices/resources/import/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual Azure Health Data Services FHIR service that receives the import. Parent-scope assignments inherit import authority to additional workspace FHIR services.
Common use cases (2)
- Perform an initial high-throughput load of FHIR NDJSON resources into an empty FHIR service.
- Run incremental or near-real-time NDJSON ingestion while preserving supported resource history metadata.
Prerequisites (3)
- Store valid resource-specific FHIR NDJSON files in Azure Blob Storage in the same tenant as the FHIR service and configure import settings.
- Grant Storage Blob Data Contributor to the FHIR service managed identity on the input storage boundary.
- Choose initial or incremental mode deliberately; initial mode blocks concurrent API writes.
Best practices (3)
- Assign directly on one FHIR service and use a dedicated import workload identity.
- Use new file names or ETags instead of updating import files in place, limit parallel jobs, and validate results and error files after every import.
- Use incremental mode when preserving version history or allowing concurrent writes is required.
Security considerations (3)
- Import can add large volumes of protected health information and can preserve historical or soft-deleted resources.
- Initial mode blocks write API calls, while incremental imports can run concurrently with CRUD operations and incur per-resource charges.
- Successfully imported resources are not rolled back when part of a job fails; input and error storage both require protection.
Assignment guidance
Assign FHIR Data Importer to the ingestion identity on the specific workspace FHIR service. Grant the FHIR service identity narrowly scoped Blob access, choose the import mode explicitly, and monitor callback and error outputs before removing the assignment.
Related roles (3)
- FHIR Data Writer: Supports ordinary FHIR write workflows rather than the dedicated high-throughput import boundary.
- FHIR Data Contributor: Provides broad FHIR data-plane access beyond import.
- Storage Blob Data Contributor: The documented separate storage role for the FHIR service managed identity to read import files and write errors.
Common questions
When should I assign the FHIR Data Importer Azure role?
Assign FHIR Data Importer when you need to: Perform an initial high-throughput load of FHIR NDJSON resources into an empty FHIR service.; and Run incremental or near-real-time NDJSON ingestion while preserving supported resource history metadata.. Practical scope: Assign on the individual Azure Health Data Services FHIR service that receives the import. Parent-scope assignments inherit import authority to additional workspace FHIR services.
What permissions does the FHIR Data Importer Azure role grant?
The role definition grants 2 combined control-plane and data-plane actions. Representative operations include: Microsoft.HealthcareApis/workspaces/fhirservices/resources/read; and Microsoft.HealthcareApis/workspaces/fhirservices/resources/import/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the FHIR Data Importer Azure role?
Key considerations when assigning FHIR Data Importer: Import can add large volumes of protected health information and can preserve historical or soft-deleted resources.; Initial mode blocks write API calls, while incremental imports can run concurrently with CRUD operations and incur per-resource charges.; and Successfully imported resources are not rolled back when part of a job fails; input and error storage both require protection.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-17.
- Configure Azure RBAC roles for Azure Health Data Services →
Supports: Practical scope, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Import data into the FHIR service →
Supports: Description, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.