Azure Internet of Things built-in role
Azure IoT Operations Onboarding
Connects the target cluster through Azure Arc and deploys Azure IoT Operations. It has broad IoT Operations control-plane access and roleAssignments/write, but its role-definition condition limits new assignments to Storage Blob Data Contributor and Azure Device Registry Administrator.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 7b7c71ed-33fa-4ed2-a91a-e56d5da260b5
Control-plane actions (10)
Microsoft.IoTOperations/*Microsoft.DeviceRegistry/register/actionMicrosoft.DeviceRegistry/schemaRegistries/readMicrosoft.DeviceRegistry/schemaRegistries/writeMicrosoft.Authorization/*/readMicrosoft.Authorization/roleAssignments/writeMicrosoft.Insights/alertRules/*Microsoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.Edge/sites/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Conditions (1)
Condition version: 2.0
((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals {ba92f5b4-2d11-453d-a403-e96b0029c9fe, 12675fd7-7f59-493f-9201-f7944860a2f1}))
Assignable scopes (1)
/
Practical scope
Assign on the resource group used for the Azure IoT Operations deployment. The conditional delegation still follows Azure scope inheritance, so a subscription assignment exposes onboarding and the allowed role grants across every inherited deployment resource group.
Common use cases (2)
- Perform the initial Azure Arc connection and Azure IoT Operations deployment for a prepared Kubernetes cluster.
- Create the constrained storage and Device Registry assignments that the documented deployment workflow needs.
Prerequisites (2)
- Prepare the supported Kubernetes cluster, register required resource providers, and identify the deployment resource group and dependency resources.
- The deploying principal also needs the documented roles for Arc-enabled Kubernetes, Key Vault, Storage, Kubernetes extensions, managed identities, monitoring, and secret synchronization when those dependencies are used.
Best practices (2)
- Treat this as a privileged, time-bounded deployment role and replace it with Azure IoT Operations Administrator or a custom task role after onboarding.
- Assign at the deployment resource group and verify the condition remains attached; do not add broader role-assignment authority merely to simplify deployment.
Security considerations (2)
- The role can deploy and delete IoT Operations resources and create two allowed role types. The condition limits which roles it can assign but does not reduce its broad IoT Operations management Actions.
- Dependency roles such as Key Vault Administrator or Managed Identity Contributor carry their own high-impact boundaries and are not manufactured by this role.
Assignment guidance
Assign Azure IoT Operations Onboarding on the target deployment resource group to the named deployment identity for the onboarding window. Verify its condition, complete and validate the deployment, then remove the role and grant the narrower administration or custom roles needed for operations.
Related roles (1)
- Azure IoT Operations Administrator: Manages an existing instance and downstream resources without the onboarding role-assignment permission.
Common questions
When should I assign the Azure IoT Operations Onboarding Azure role?
Assign Azure IoT Operations Onboarding when you need to: Perform the initial Azure Arc connection and Azure IoT Operations deployment for a prepared Kubernetes cluster.; and Create the constrained storage and Device Registry assignments that the documented deployment workflow needs.. Practical scope: Assign on the resource group used for the Azure IoT Operations deployment. The conditional delegation still follows Azure scope inheritance, so a subscription assignment exposes onboarding and the allowed role grants across every inherited deployment resource group.
What permissions does the Azure IoT Operations Onboarding Azure role grant?
The role definition grants 10 combined control-plane and data-plane actions. Representative operations include: Microsoft.IoTOperations/*; Microsoft.DeviceRegistry/register/action; Microsoft.DeviceRegistry/schemaRegistries/read; Microsoft.DeviceRegistry/schemaRegistries/write; Microsoft.Authorization/*/read; and Microsoft.Authorization/roleAssignments/write. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure IoT Operations Onboarding Azure role?
Key considerations when assigning Azure IoT Operations Onboarding: The role can deploy and delete IoT Operations resources and create two allowed role types. The condition limits which roles it can assign but does not reduce its broad IoT Operations management Actions.; and Dependency roles such as Key Vault Administrator or Managed Identity Contributor carry their own high-impact boundaries and are not manufactured by this role.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Internet of Things - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Deployment overview - Azure IoT Operations →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Custom RBAC roles for your Azure IoT Operations resources →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.