Azure AI + machine learning built-in role
Healthcare Agent Admin
Provides full Healthcare Agent management-portal access to bot resources, scenarios, configuration, instance keys and secrets, and user access. The imported role has no control-plane Actions; its authority is expressed entirely through Healthcare Agent DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: f1082fec-a70f-419f-9230-885d2550fb38
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (19)
Microsoft.HealthBot/healthBots/ResourceData/ReadMicrosoft.HealthBot/healthBots/Metadata/ReadMicrosoft.HealthBot/healthBots/CopilotStudioSolution/*Microsoft.HealthBot/healthBots/Feedback/ReadMicrosoft.HealthBot/healthBots/Users/ReadMicrosoft.HealthBot/healthBots/AuditTrails/ReadMicrosoft.HealthBot/healthBots/AnalyticReport/ReadMicrosoft.HealthBot/healthBots/ExposedSkill/ReadMicrosoft.HealthBot/healthBots/RegisteredSkills/ReadMicrosoft.HealthBot/healthBots/Configuration/*Microsoft.HealthBot/healthBots/Localization/*Microsoft.HealthBot/healthBots/AuthenticationProviders/*Microsoft.HealthBot/healthBots/Channels/*Microsoft.HealthBot/healthBots/DataConnections/*Microsoft.HealthBot/healthBots/OpenAPIPlugins/*Microsoft.HealthBot/healthBots/Scenarios/*Microsoft.HealthBot/healthBots/LanguageModels/*Microsoft.HealthBot/healthBots/Resources/*Microsoft.HealthBot/healthBots/Admin/*
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual Healthcare Agent service resource. A parent-scope assignment is inherited by every Healthcare Agent instance below that scope and grants portal administration across them.
Common use cases (2)
- Administer all bot resources, scenarios, configuration settings, keys, secrets, and portal access for one Healthcare Agent instance.
- Enable Microsoft Entra Access Management for an existing instance and reassign its users through Azure Access control (IAM).
Prerequisites (2)
- The Healthcare Agent service instance and Microsoft Entra users or groups must exist.
- For an existing instance moving to Microsoft Entra access management, inventory legacy portal users before enabling the toggle and recreate their access through Azure IAM.
Best practices (3)
- Limit Admin to the small set of people who manage instance secrets and user access; use Editor or Reader for other portal users.
- Assign directly on the Healthcare Agent resource and manage membership through Microsoft Entra groups where appropriate.
- Review administrators after enabling Microsoft Entra access management and remove legacy or stale assignments.
Security considerations (3)
- Admin can access instance keys and secrets, change all bot configuration and scenarios, and manage who can enter the portal.
- The role consists of DataActions even though it performs administrative work inside the Healthcare Agent service.
- A parent-scope assignment grants full portal and secret access to multiple inherited instances.
Assignment guidance
Assign Healthcare Agent Admin on the individual instance only to portal security and service owners. Use Admin to enable Microsoft Entra access management and assign Editor or Reader to other users through Azure IAM.
Related roles (2)
- Healthcare Agent Editor: Edits bot resources and configuration without the documented instance-key, secret, and end-user-input access of Admin.
- Healthcare Agent Reader: Provides read-only portal access with documented exclusions for secrets, end-user inputs, and user management.
Common questions
When should I assign the Healthcare Agent Admin Azure role?
Assign Healthcare Agent Admin when you need to: Administer all bot resources, scenarios, configuration settings, keys, secrets, and portal access for one Healthcare Agent instance.; and Enable Microsoft Entra Access Management for an existing instance and reassign its users through Azure Access control (IAM).. Practical scope: Assign on the individual Healthcare Agent service resource. A parent-scope assignment is inherited by every Healthcare Agent instance below that scope and grants portal administration across them.
What permissions does the Healthcare Agent Admin Azure role grant?
The role definition grants 19 combined control-plane and data-plane actions. Representative operations include: Microsoft.HealthBot/healthBots/ResourceData/Read; Microsoft.HealthBot/healthBots/Metadata/Read; Microsoft.HealthBot/healthBots/CopilotStudioSolution/*; Microsoft.HealthBot/healthBots/Feedback/Read; Microsoft.HealthBot/healthBots/Users/Read; and Microsoft.HealthBot/healthBots/AuditTrails/Read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Healthcare Agent Admin Azure role?
Key considerations when assigning Healthcare Agent Admin: Admin can access instance keys and secrets, change all bot configuration and scenarios, and manage who can enter the portal.; The role consists of DataActions even though it performs administrative work inside the Healthcare Agent service.; and A parent-scope assignment grants full portal and secret access to multiple inherited instances.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for AI + machine learning - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role - Azure RBAC | Microsoft Learn →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC | Microsoft Learn →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC | Microsoft Learn →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Portal users - Healthcare agent service | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.