Azure AI + machine learning built-in role

Healthcare Agent Editor

Edits Healthcare Agent bot resources, scenarios, and configuration while the product access matrix excludes bot instance keys, secrets, and end-user inputs and provides read-only access to skills, channels, and user management. The imported role has Healthcare Agent DataActions and no control-plane Actions.

Control-plane actions (0)

None — this role grants no control-plane management actions.

Data-plane actions (18)

• Microsoft.HealthBot/healthBots/ResourceData/Read
• Microsoft.HealthBot/healthBots/Metadata/Read
• Microsoft.HealthBot/healthBots/CopilotStudioSolution/*
• Microsoft.HealthBot/healthBots/Feedback/Read
• Microsoft.HealthBot/healthBots/Users/Read
• Microsoft.HealthBot/healthBots/AuditTrails/Read
• Microsoft.HealthBot/healthBots/AnalyticReport/Read
• Microsoft.HealthBot/healthBots/ExposedSkill/Read
• Microsoft.HealthBot/healthBots/RegisteredSkills/Read
• Microsoft.HealthBot/healthBots/Configuration/*
• Microsoft.HealthBot/healthBots/Localization/*
• Microsoft.HealthBot/healthBots/AuthenticationProviders/*
• Microsoft.HealthBot/healthBots/Channels/*
• Microsoft.HealthBot/healthBots/DataConnections/*
• Microsoft.HealthBot/healthBots/OpenAPIPlugins/*
• Microsoft.HealthBot/healthBots/Scenarios/*
• Microsoft.HealthBot/healthBots/LanguageModels/*
• Microsoft.HealthBot/healthBots/Resources/*

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the individual Healthcare Agent service resource whose bot content the editor maintains. A parent-scope assignment is inherited by every instance below it.

Common use cases (2)

• Build and maintain Healthcare Agent scenarios, language models, localization, connections, plugins, and other bot resources without full portal administration.
• Review skills, channels, and user-management information while leaving secrets and access administration with Healthcare Agent Admin.

Prerequisites (2)

• The Healthcare Agent instance must exist and use Azure IAM or the approved existing access-management workflow.
• A Healthcare Agent Admin must assign the editor and retain responsibility for instance keys, secrets, and user access.

Best practices (3)

• Use Editor for bot authors instead of Admin and assign Reader to users who do not change bot content.
• Assign at the individual instance and review effective DataActions when service permissions or the portal access model change.
• Separate content authoring from instance secret and access administration.

Security considerations (3)

• The role can make broad changes to bot scenarios, configuration, connections, plugins, language models, and resources, affecting behavior and data flows.
• Microsoft documents instance keys, secrets, and end-user inputs as excluded from the Editor experience, but the current role definition should still be reviewed when approving access because it publishes broad Healthcare Agent DataActions.
• A parent-scope assignment grants editing authority across multiple inherited instances.

Assignment guidance

Assign Healthcare Agent Editor on the individual instance to bot authors who change scenarios and configuration but do not administer secrets or user access. Keep Admin with service owners and use Reader for view-only users.

Related roles (2)

• Healthcare Agent Admin: Adds instance keys, secrets, full administration, and portal user-access management.
• Healthcare Agent Reader: Read-only alternative for users who should not modify bot content or configuration.

Editorial sources (5)

• Azure built-in roles for AI + machine learning - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role - Azure RBAC | Microsoft Learn →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC | Microsoft Learn →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC | Microsoft Learn →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Portal users - Healthcare agent service | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →