Azure Monitor built-in role

Log Analytics Data Reader

Provides the minimum permissions to run Log Analytics queries, see workspace metadata, and read authorized table data. Its query and workspace reads are control-plane Actions that do not grant row access; its table data read is a DataAction that can be constrained by table- and row-level assignment conditions.

Control-plane actions (2)

• Microsoft.OperationalInsights/workspaces/query/read
• Microsoft.OperationalInsights/workspaces/read

Data-plane actions (1)

• Microsoft.OperationalInsights/workspaces/tables/data/read

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign at the Log Analytics workspace for the simplest granular RBAC model, then use conditions on the DataAction to limit tables or rows. Without a condition, the DataAction grants data access at the assigned scope; broader assignments are inherited and additive.

Common use cases (2)

• Let a user query only approved Log Analytics tables or rows by applying granular RBAC conditions to the built-in Data Reader role.
• Separate permission to run a query and view metadata in the control plane from permission to read matching log rows in the data plane.

Prerequisites (2)

• Plan the workspace, table, and row attributes that define the allowed data and select the workspace access control mode required by the query context.
• The administrator configuring conditions needs role-assignment write and delete permissions on the workspace, and broader assignments that bypass the restriction must be removed.

Best practices (3)

• Assign at the workspace and put table or row restrictions on the DataAction instead of spreading control and data permissions across broader scopes.
• Review the principal's complete additive role set so a separate broad read assignment does not override the intended restriction.
• Enable and review Log Analytics query auditing to confirm when ABAC conditions apply.

Security considerations (3)

• The control-plane query Action permits running queries and seeing metadata but does not itself authorize access to log rows.
• The table data DataAction grants access to all data at the assigned scope when no condition is present.
• Azure RBAC is additive; a separate higher-access assignment can expose data that a conditional assignment was intended to restrict.

Assignment guidance

Assign Log Analytics Data Reader on the workspace and add the reviewed table- or row-level conditions to its DataAction. Remove conflicting broad read assignments, verify the access control mode for the intended query context, and test both allowed and denied data.

Related roles (2)

• Log Analytics Reader: Broader role that can view all monitoring data and settings in scope rather than acting as the minimum conditional data reader.
• Privileged Monitoring Data Reader: Microsoft documents this separate role for access to protected tables, while Log Analytics Data Reader is the base role for custom granular conditions.

Editorial sources (6)

• Azure built-in roles for Monitor →

  Supports: Description. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Granular RBAC in Azure Monitor →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Manage access to Log Analytics workspaces →

  Supports: Description, Practical scope, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →