Azure AI + machine learning built-in role
Healthcare Agent Reader
Provides read-only Healthcare Agent portal access to bot resources, scenarios, and configuration while excluding instance keys and secrets, end-user inputs, and portal user management. The imported role has read-oriented Healthcare Agent DataActions and no control-plane Actions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: eb5a76d5-50e7-4c33-a449-070e7c9c4cf2
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (17)
Microsoft.HealthBot/healthBots/ResourceData/ReadMicrosoft.HealthBot/healthBots/Metadata/ReadMicrosoft.HealthBot/healthBots/CopilotStudioSolution/RestoreBuiltinTemplate/ReadMicrosoft.HealthBot/healthBots/Feedback/ReadMicrosoft.HealthBot/healthBots/Users/ReadMicrosoft.HealthBot/healthBots/AuditTrails/ReadMicrosoft.HealthBot/healthBots/AnalyticReport/ReadMicrosoft.HealthBot/healthBots/ExposedSkill/ReadMicrosoft.HealthBot/healthBots/RegisteredSkills/ReadMicrosoft.HealthBot/healthBots/Configuration/ReadMicrosoft.HealthBot/healthBots/Localization/ReadMicrosoft.HealthBot/healthBots/AuthenticationProviders/ReadMicrosoft.HealthBot/healthBots/DataConnections/ReadMicrosoft.HealthBot/healthBots/OpenAPIPlugins/ReadMicrosoft.HealthBot/healthBots/Scenarios/*/ReadMicrosoft.HealthBot/healthBots/LanguageModels/ReadMicrosoft.HealthBot/healthBots/Resources/Files/Read
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual Healthcare Agent service resource the reviewer must inspect. A parent-scope assignment is inherited by every instance below that scope.
Common use cases (2)
- Review Healthcare Agent scenarios, resources, metadata, configuration, localization, and analytics without editing the bot.
- Give support, audit, or stakeholder users portal visibility while keeping secrets, end-user inputs, and user management unavailable.
Prerequisites (2)
- The Healthcare Agent instance must exist and the user must be assigned through Azure IAM or the approved existing access-management workflow.
- Confirm that the reviewer does not require content changes or access to instance secrets and end-user inputs.
Best practices (3)
- Use Reader for support, audit, and stakeholder access instead of Editor or Admin.
- Assign directly on the Healthcare Agent resource and review group membership when responsibilities change.
- Elevate only for the period in which content editing or administration is required.
Security considerations (3)
- Read access can expose bot scenarios, configuration, resource metadata, analytics, and operational context.
- Microsoft documents instance keys, secrets, end-user inputs, and portal user management as excluded from Reader access.
- A parent-scope assignment exposes portal content from every inherited Healthcare Agent instance.
Assignment guidance
Assign Healthcare Agent Reader on the individual instance to support, audit, or stakeholder users who only inspect portal content. Use Editor for approved bot changes and Admin only for secrets and access management.
Related roles (2)
- Healthcare Agent Editor: Adds bot resource, scenario, and configuration changes while retaining documented secret and end-user-input exclusions.
- Healthcare Agent Admin: Adds full bot administration, keys, secrets, and portal user-access management.
Common questions
When should I assign the Healthcare Agent Reader Azure role?
Assign Healthcare Agent Reader when you need to: Review Healthcare Agent scenarios, resources, metadata, configuration, localization, and analytics without editing the bot.; and Give support, audit, or stakeholder users portal visibility while keeping secrets, end-user inputs, and user management unavailable.. Practical scope: Assign on the individual Healthcare Agent service resource the reviewer must inspect. A parent-scope assignment is inherited by every instance below that scope.
What permissions does the Healthcare Agent Reader Azure role grant?
The role definition grants 17 combined control-plane and data-plane actions. Representative operations include: Microsoft.HealthBot/healthBots/ResourceData/Read; Microsoft.HealthBot/healthBots/Metadata/Read; Microsoft.HealthBot/healthBots/CopilotStudioSolution/RestoreBuiltinTemplate/Read; Microsoft.HealthBot/healthBots/Feedback/Read; Microsoft.HealthBot/healthBots/Users/Read; and Microsoft.HealthBot/healthBots/AuditTrails/Read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Healthcare Agent Reader Azure role?
Key considerations when assigning Healthcare Agent Reader: Read access can expose bot scenarios, configuration, resource metadata, analytics, and operational context.; Microsoft documents instance keys, secrets, end-user inputs, and portal user management as excluded from Reader access.; and A parent-scope assignment exposes portal content from every inherited Healthcare Agent instance.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for AI + machine learning - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role - Azure RBAC | Microsoft Learn →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC | Microsoft Learn →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC | Microsoft Learn →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Portal users - Healthcare agent service | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.