Azure AI + machine learning built-in role
Healthcare Agent Editor
Edits Healthcare Agent bot resources, scenarios, and configuration while the product access matrix excludes bot instance keys, secrets, and end-user inputs and provides read-only access to skills, channels, and user management. The imported role has Healthcare Agent DataActions and no control-plane Actions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: af854a69-80ce-4ff7-8447-f1118a2e0ca8
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (18)
Microsoft.HealthBot/healthBots/ResourceData/ReadMicrosoft.HealthBot/healthBots/Metadata/ReadMicrosoft.HealthBot/healthBots/CopilotStudioSolution/*Microsoft.HealthBot/healthBots/Feedback/ReadMicrosoft.HealthBot/healthBots/Users/ReadMicrosoft.HealthBot/healthBots/AuditTrails/ReadMicrosoft.HealthBot/healthBots/AnalyticReport/ReadMicrosoft.HealthBot/healthBots/ExposedSkill/ReadMicrosoft.HealthBot/healthBots/RegisteredSkills/ReadMicrosoft.HealthBot/healthBots/Configuration/*Microsoft.HealthBot/healthBots/Localization/*Microsoft.HealthBot/healthBots/AuthenticationProviders/*Microsoft.HealthBot/healthBots/Channels/*Microsoft.HealthBot/healthBots/DataConnections/*Microsoft.HealthBot/healthBots/OpenAPIPlugins/*Microsoft.HealthBot/healthBots/Scenarios/*Microsoft.HealthBot/healthBots/LanguageModels/*Microsoft.HealthBot/healthBots/Resources/*
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual Healthcare Agent service resource whose bot content the editor maintains. A parent-scope assignment is inherited by every instance below it.
Common use cases (2)
- Build and maintain Healthcare Agent scenarios, language models, localization, connections, plugins, and other bot resources without full portal administration.
- Review skills, channels, and user-management information while leaving secrets and access administration with Healthcare Agent Admin.
Prerequisites (2)
- The Healthcare Agent instance must exist and use Azure IAM or the approved existing access-management workflow.
- A Healthcare Agent Admin must assign the editor and retain responsibility for instance keys, secrets, and user access.
Best practices (3)
- Use Editor for bot authors instead of Admin and assign Reader to users who do not change bot content.
- Assign at the individual instance and review effective DataActions when service permissions or the portal access model change.
- Separate content authoring from instance secret and access administration.
Security considerations (3)
- The role can make broad changes to bot scenarios, configuration, connections, plugins, language models, and resources, affecting behavior and data flows.
- Microsoft documents instance keys, secrets, and end-user inputs as excluded from the Editor experience, but the current role definition should still be reviewed when approving access because it publishes broad Healthcare Agent DataActions.
- A parent-scope assignment grants editing authority across multiple inherited instances.
Assignment guidance
Assign Healthcare Agent Editor on the individual instance to bot authors who change scenarios and configuration but do not administer secrets or user access. Keep Admin with service owners and use Reader for view-only users.
Related roles (2)
- Healthcare Agent Admin: Adds instance keys, secrets, full administration, and portal user-access management.
- Healthcare Agent Reader: Read-only alternative for users who should not modify bot content or configuration.
Common questions
When should I assign the Healthcare Agent Editor Azure role?
Assign Healthcare Agent Editor when you need to: Build and maintain Healthcare Agent scenarios, language models, localization, connections, plugins, and other bot resources without full portal administration.; and Review skills, channels, and user-management information while leaving secrets and access administration with Healthcare Agent Admin.. Practical scope: Assign on the individual Healthcare Agent service resource whose bot content the editor maintains. A parent-scope assignment is inherited by every instance below it.
What permissions does the Healthcare Agent Editor Azure role grant?
The role definition grants 18 combined control-plane and data-plane actions. Representative operations include: Microsoft.HealthBot/healthBots/ResourceData/Read; Microsoft.HealthBot/healthBots/Metadata/Read; Microsoft.HealthBot/healthBots/CopilotStudioSolution/*; Microsoft.HealthBot/healthBots/Feedback/Read; Microsoft.HealthBot/healthBots/Users/Read; and Microsoft.HealthBot/healthBots/AuditTrails/Read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Healthcare Agent Editor Azure role?
Key considerations when assigning Healthcare Agent Editor: The role can make broad changes to bot scenarios, configuration, connections, plugins, language models, and resources, affecting behavior and data flows.; Microsoft documents instance keys, secrets, and end-user inputs as excluded from the Editor experience, but the current role definition should still be reviewed when approving access because it publishes broad Healthcare Agent DataActions.; and A parent-scope assignment grants editing authority across multiple inherited instances.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for AI + machine learning - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role - Azure RBAC | Microsoft Learn →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC | Microsoft Learn →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC | Microsoft Learn →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Portal users - Healthcare agent service | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.