Azure Integration built-in role

FHIR SMART User

Provides the FHIR data-plane actions required for SMART on FHIR authorization, including read, read-by-ID, search, and the SMART-specific action. Current Microsoft Learn feature guidance states that the role does not grant FHIR write access, despite older role-table wording that describes SMART access more broadly.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: 4ba50f17-9666-485c-a643-ff00808643f0

Control-plane actions (0)

None — this role grants no control-plane management actions.

Data-plane actions (8)

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

Assign approved end users on the individual FHIR service used by the SMART workflow. Azure RBAC establishes the service boundary for the user, while SMART clinical scopes and fhirUser or launch context further constrain each request.

Common use cases (2)

Prerequisites (2)

Best practices (4)

Security considerations (4)

Assignment guidance

Assign FHIR SMART User to each approved end user on the specific FHIR service, then configure the SMART client, narrow clinical scopes, and launch context separately. Do not recommend the role to the client application without current official evidence, and do not use FHIR Data Contributor as a substitute because its published definition excludes the SMART-specific action.

Related roles (2)

Common questions

When should I assign the FHIR SMART User Azure role?

Assign FHIR SMART User when you need to: Authorize an end user to read FHIR data through a SMART client when the request satisfies the approved clinical scopes and fhirUser or launch context.; and Support an EHR-integrated application that uses OAuth 2.0, OpenID Connect, and SMART discovery against one FHIR service.. Practical scope: Assign approved end users on the individual FHIR service used by the SMART workflow. Azure RBAC establishes the service boundary for the user, while SMART clinical scopes and fhirUser or launch context further constrain each request.

What permissions does the FHIR SMART User Azure role grant?

The role definition grants 8 combined control-plane and data-plane actions. Representative operations include: Microsoft.HealthcareApis/services/fhir/resources/read; Microsoft.HealthcareApis/services/fhir/resources/readById/action; Microsoft.HealthcareApis/services/fhir/resources/search/action; Microsoft.HealthcareApis/services/fhir/resources/smart/action; Microsoft.HealthcareApis/workspaces/fhirservices/resources/read; and Microsoft.HealthcareApis/workspaces/fhirservices/resources/readById/action. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the FHIR SMART User Azure role?

Key considerations when assigning FHIR SMART User: SMART tokens can expose protected health information, but access is constrained by both the Azure role and the granted SMART clinical scopes and context.; The current Microsoft Learn workflow assigns FHIR SMART User to end users; client registration and orchestration are separate setup steps and do not justify transferring the user role to the app principal.; The current published DataActions and feature guidance do not grant general FHIR write access.; and A parent-scope Azure assignment broadens the service boundary even though SMART scopes still apply within each request.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (8)

Official Microsoft Learn documentation →