Azure Internet of Things built-in role

Azure IoT Operations Onboarding

Connects the target cluster through Azure Arc and deploys Azure IoT Operations. It has broad IoT Operations control-plane access and roleAssignments/write, but its role-definition condition limits new assignments to Storage Blob Data Contributor and Azure Device Registry Administrator.

Control-plane actions (10)

• Microsoft.IoTOperations/*
• Microsoft.DeviceRegistry/register/action
• Microsoft.DeviceRegistry/schemaRegistries/read
• Microsoft.DeviceRegistry/schemaRegistries/write
• Microsoft.Authorization/*/read
• Microsoft.Authorization/roleAssignments/write
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Edge/sites/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Conditions (1)

• Condition version: 2.0

  ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals {ba92f5b4-2d11-453d-a403-e96b0029c9fe, 12675fd7-7f59-493f-9201-f7944860a2f1}))

Assignable scopes (1)

• /

Practical scope

Assign on the resource group used for the Azure IoT Operations deployment. The conditional delegation still follows Azure scope inheritance, so a subscription assignment exposes onboarding and the allowed role grants across every inherited deployment resource group.

Common use cases (2)

• Perform the initial Azure Arc connection and Azure IoT Operations deployment for a prepared Kubernetes cluster.
• Create the constrained storage and Device Registry assignments that the documented deployment workflow needs.

Prerequisites (2)

• Prepare the supported Kubernetes cluster, register required resource providers, and identify the deployment resource group and dependency resources.
• The deploying principal also needs the documented roles for Arc-enabled Kubernetes, Key Vault, Storage, Kubernetes extensions, managed identities, monitoring, and secret synchronization when those dependencies are used.

Best practices (2)

• Treat this as a privileged, time-bounded deployment role and replace it with Azure IoT Operations Administrator or a custom task role after onboarding.
• Assign at the deployment resource group and verify the condition remains attached; do not add broader role-assignment authority merely to simplify deployment.

Security considerations (2)

• The role can deploy and delete IoT Operations resources and create two allowed role types. The condition limits which roles it can assign but does not reduce its broad IoT Operations management Actions.
• Dependency roles such as Key Vault Administrator or Managed Identity Contributor carry their own high-impact boundaries and are not manufactured by this role.

Assignment guidance

Assign Azure IoT Operations Onboarding on the target deployment resource group to the named deployment identity for the onboarding window. Verify its condition, complete and validate the deployment, then remove the role and grant the narrower administration or custom roles needed for operations.

Related roles (1)

• Azure IoT Operations Administrator: Manages an existing instance and downstream resources without the onboarding role-assignment permission.

Editorial sources (7)

• Azure built-in roles for Internet of Things - Azure RBAC | Microsoft Learn →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Deployment overview - Azure IoT Operations →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Custom RBAC roles for your Azure IoT Operations resources →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →