Azure Analytics built-in role

HDInsight Domain Services Contributor

Authorizes the user-assigned managed identity used by an HDInsight Enterprise Security Package cluster to read Microsoft Entra Domain Services and create, modify, or delete required organizational-unit operations. The role uses control-plane Actions and no DataActions. Enterprise Security Package support ends July 31, 2026.

Control-plane actions (3)

• Microsoft.AAD/*/read
• Microsoft.AAD/domainServices/*/read
• Microsoft.AAD/domainServices/oucontainer/*

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Microsoft directs administrators to assign this role to the user-assigned managed identity in Access control (IAM) on the Microsoft Entra Domain Services resource. A broader parent assignment is inherited by other resources below that scope and is not required by the documented ESP setup.

Common use cases (2)

• Maintain the domain-services operations required by an existing ESP-enabled HDInsight cluster during its final supported migration or decommissioning period.
• Allow the cluster managed identity to create and delete the organizational units required by the documented ESP integration.

Prerequisites (3)

• Microsoft Entra Domain Services must be enabled, healthy, synchronized, and reachable from the HDInsight network with the documented DNS and network configuration.
• Create a user-assigned managed identity and have a Microsoft Entra Domain Services administrator authorize it before using it for an ESP cluster.
• Plan for Enterprise Security Package support to end on July 31, 2026.

Best practices (3)

• Use a user-assigned managed identity for the domain-services operations and assign the role on the Domain Services resource rather than a broader scope.
• Use scoped synchronization when only selected Microsoft Entra groups need cluster access.
• Complete migration or decommissioning before support ends and remove the role assignment when the ESP integration no longer uses the managed identity.

Security considerations (3)

• The role permits the managed identity to create and delete organizational units used by ESP in Microsoft Entra Domain Services.
• Users or groups with Managed Identity Operator on this managed identity can use it when creating ESP clusters, so that separate assignment controls who can exercise the identity.
• Enterprise Security Package is retiring and reaches end of support on July 31, 2026; retaining its access path after migration or decommissioning leaves unnecessary authorization in place.

Assignment guidance

For an existing ESP environment that still requires domain operations before support ends, assign HDInsight Domain Services Contributor to its user-assigned managed identity on the Microsoft Entra Domain Services resource. Grant Managed Identity Operator separately only to approved users or groups that must use the identity, then remove both access paths when migration or decommissioning is complete.

Related roles (1)

• Managed Identity Operator: Microsoft directs the Domain Services administrator to grant Managed Identity Operator to the users or groups allowed to use the authorized managed identity for ESP cluster creation.

Editorial sources (7)

• Azure built-in roles for Analytics →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-17.

• Remove Azure role assignments →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Configure clusters for Microsoft Entra integration →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →