Azure Analytics built-in role

HDInsight Cluster Operator

Reads and modifies HDInsight cluster configurations, including sensitive configuration values and gateway settings, without the broader resource-administration authority of Contributor or Owner. The role grants control-plane Actions and no DataActions.

Control-plane actions (9)

• Microsoft.HDInsight/*/read
• Microsoft.HDInsight/clusters/getGatewaySettings/action
• Microsoft.HDInsight/clusters/updateGatewaySettings/action
• Microsoft.HDInsight/clusters/configurations/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Resources/deployments/operations/read
• Microsoft.Insights/alertRules/*
• Microsoft.Authorization/*/read
• Microsoft.Support/*

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Microsoft documents assignment at an individual HDInsight cluster, resource group, or subscription. Parent assignments are inherited; cluster scope limits access to the selected cluster and is the narrowest documented option.

Common use cases (2)

• Retrieve all HDInsight cluster configurations, including sensitive parameters omitted from Reader access.
• Read or update HDInsight gateway settings without granting Contributor or Owner over the cluster resources.

Prerequisites (2)

• Use the current HDInsight REST API, SDK, PowerShell, or supported development-tool versions that implement the granular configuration endpoints.
• The role-assignment administrator needs role-assignment write permission at the selected scope and must identify the user or service principal receiving configuration access.

Best practices (3)

• Assign at the individual cluster rather than the resource group or subscription when only one cluster requires configuration access.
• Use Reader when the principal does not need secrets or configuration writes, and use HDInsight Cluster Operator instead of Contributor or Owner when those broader administration rights are unnecessary.
• Update affected clients to the replacement configuration and gateway APIs before relying on the role.

Security considerations (3)

• The protected configurations can contain cluster gateway credentials, storage account keys, and database credentials that can provide access beyond ordinary cluster reads.
• The role can retrieve sensitive configurations and update gateway credentials even though its definition contains no DataActions.
• A resource-group or subscription assignment exposes sensitive configuration values for every inherited HDInsight cluster.

Assignment guidance

Assign HDInsight Cluster Operator on the specific cluster to a user or service principal that must read or update sensitive cluster configurations. Use Reader when secrets are not required, and choose a parent scope only when the same approved operator must manage every inherited cluster.

Related roles (3)

• Reader: Reader retains ordinary cluster read access but Microsoft documents that it cannot retrieve sensitive configuration values.
• Contributor: Contributor can also retrieve and update configurations but includes broader Azure resource administration and script-action authority.
• Owner: Owner can also access sensitive configurations and adds full resource and access-delegation authority.

Editorial sources (6)

• Azure built-in roles for Analytics →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Granular role-based access Azure HDInsight cluster configurations →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →