Azure Integration built-in role

FHIR SMART User

Provides the FHIR data-plane actions required for SMART on FHIR authorization, including read, read-by-ID, search, and the SMART-specific action. Current Microsoft Learn feature guidance states that the role does not grant FHIR write access, despite older role-table wording that describes SMART access more broadly.

Control-plane actions (0)

None — this role grants no control-plane management actions.

Data-plane actions (8)

• Microsoft.HealthcareApis/services/fhir/resources/read
• Microsoft.HealthcareApis/services/fhir/resources/readById/action
• Microsoft.HealthcareApis/services/fhir/resources/search/action
• Microsoft.HealthcareApis/services/fhir/resources/smart/action
• Microsoft.HealthcareApis/workspaces/fhirservices/resources/read
• Microsoft.HealthcareApis/workspaces/fhirservices/resources/readById/action
• Microsoft.HealthcareApis/workspaces/fhirservices/resources/search/action
• Microsoft.HealthcareApis/workspaces/fhirservices/resources/smart/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign approved end users on the individual FHIR service used by the SMART workflow. Azure RBAC establishes the service boundary for the user, while SMART clinical scopes and fhirUser or launch context further constrain each request.

Common use cases (2)

• Authorize an end user to read FHIR data through a SMART client when the request satisfies the approved clinical scopes and fhirUser or launch context.
• Support an EHR-integrated application that uses OAuth 2.0, OpenID Connect, and SMART discovery against one FHIR service.

Prerequisites (2)

• An Azure Health Data Services FHIR service, SMART-capable identity provider strategy, test patient, and registered SMART client application must exist.
• Configure FHIR authentication settings and request only the clinical scopes and context required by the application.

Best practices (4)

• Assign the role to approved end users on one FHIR service and combine it with narrow SMART scopes, patient or user context, and explicit client registration.
• Do not assign FHIR SMART User to the client application unless a current official workflow explicitly requires that principal; the reviewed Microsoft Learn setup assigns the role to end users.
• Test discovery, authorization, token exchange, and FHIR calls end to end and do not treat this role as unrestricted repository access.
• Use Data Writer or another non-SMART role only when a separate trusted workflow requires writes outside the current SMART read boundary.

Security considerations (4)

• SMART tokens can expose protected health information, but access is constrained by both the Azure role and the granted SMART clinical scopes and context.
• The current Microsoft Learn workflow assigns FHIR SMART User to end users; client registration and orchestration are separate setup steps and do not justify transferring the user role to the app principal.
• The current published DataActions and feature guidance do not grant general FHIR write access.
• A parent-scope Azure assignment broadens the service boundary even though SMART scopes still apply within each request.

Assignment guidance

Assign FHIR SMART User to each approved end user on the specific FHIR service, then configure the SMART client, narrow clinical scopes, and launch context separately. Do not recommend the role to the client application without current official evidence, and do not use FHIR Data Contributor as a substitute because its published definition excludes the SMART-specific action.

Related roles (2)

• FHIR Data Reader: Provides general repository read and search access without the SMART-specific authorization action and clinical-scope model.
• FHIR Data Contributor: Provides broad general FHIR data access but explicitly excludes the SMART-specific action.

Editorial sources (8)

• Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →

  Supports: Description, Security considerations, Related roles. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-17.

• Configure Azure RBAC roles for Azure Health Data Services →

  Supports: Practical scope, Assignment guidance, Related roles. Retrieved 2026-07-17.

• SMART on FHIR →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Supported FHIR Features →

  Supports: Description, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →