Azure Analytics built-in role
HDInsight Cluster Operator
Reads and modifies HDInsight cluster configurations, including sensitive configuration values and gateway settings, without the broader resource-administration authority of Contributor or Owner. The role grants control-plane Actions and no DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 61ed4efc-fab3-44fd-b111-e24485cc132a
Control-plane actions (9)
Microsoft.HDInsight/*/readMicrosoft.HDInsight/clusters/getGatewaySettings/actionMicrosoft.HDInsight/clusters/updateGatewaySettings/actionMicrosoft.HDInsight/clusters/configurations/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.Resources/deployments/operations/readMicrosoft.Insights/alertRules/*Microsoft.Authorization/*/readMicrosoft.Support/*
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Microsoft documents assignment at an individual HDInsight cluster, resource group, or subscription. Parent assignments are inherited; cluster scope limits access to the selected cluster and is the narrowest documented option.
Common use cases (2)
- Retrieve all HDInsight cluster configurations, including sensitive parameters omitted from Reader access.
- Read or update HDInsight gateway settings without granting Contributor or Owner over the cluster resources.
Prerequisites (2)
- Use the current HDInsight REST API, SDK, PowerShell, or supported development-tool versions that implement the granular configuration endpoints.
- The role-assignment administrator needs role-assignment write permission at the selected scope and must identify the user or service principal receiving configuration access.
Best practices (3)
- Assign at the individual cluster rather than the resource group or subscription when only one cluster requires configuration access.
- Use Reader when the principal does not need secrets or configuration writes, and use HDInsight Cluster Operator instead of Contributor or Owner when those broader administration rights are unnecessary.
- Update affected clients to the replacement configuration and gateway APIs before relying on the role.
Security considerations (3)
- The protected configurations can contain cluster gateway credentials, storage account keys, and database credentials that can provide access beyond ordinary cluster reads.
- The role can retrieve sensitive configurations and update gateway credentials even though its definition contains no DataActions.
- A resource-group or subscription assignment exposes sensitive configuration values for every inherited HDInsight cluster.
Assignment guidance
Assign HDInsight Cluster Operator on the specific cluster to a user or service principal that must read or update sensitive cluster configurations. Use Reader when secrets are not required, and choose a parent scope only when the same approved operator must manage every inherited cluster.
Related roles (3)
- Reader: Reader retains ordinary cluster read access but Microsoft documents that it cannot retrieve sensitive configuration values.
- Contributor: Contributor can also retrieve and update configurations but includes broader Azure resource administration and script-action authority.
- Owner: Owner can also access sensitive configurations and adds full resource and access-delegation authority.
Common questions
When should I assign the HDInsight Cluster Operator Azure role?
Assign HDInsight Cluster Operator when you need to: Retrieve all HDInsight cluster configurations, including sensitive parameters omitted from Reader access.; and Read or update HDInsight gateway settings without granting Contributor or Owner over the cluster resources.. Practical scope: Microsoft documents assignment at an individual HDInsight cluster, resource group, or subscription. Parent assignments are inherited; cluster scope limits access to the selected cluster and is the narrowest documented option.
What permissions does the HDInsight Cluster Operator Azure role grant?
The role definition grants 9 combined control-plane and data-plane actions. Representative operations include: Microsoft.HDInsight/*/read; Microsoft.HDInsight/clusters/getGatewaySettings/action; Microsoft.HDInsight/clusters/updateGatewaySettings/action; Microsoft.HDInsight/clusters/configurations/*; Microsoft.Resources/subscriptions/resourceGroups/read; and Microsoft.Resources/deployments/operations/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the HDInsight Cluster Operator Azure role?
Key considerations when assigning HDInsight Cluster Operator: The protected configurations can contain cluster gateway credentials, storage account keys, and database credentials that can provide access beyond ordinary cluster reads.; The role can retrieve sensitive configurations and update gateway credentials even though its definition contains no DataActions.; and A resource-group or subscription assignment exposes sensitive configuration values for every inherited HDInsight cluster.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Analytics →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Granular role-based access Azure HDInsight cluster configurations →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.