Azure Monitor built-in role
Log Analytics Data Reader
Provides the minimum permissions to run Log Analytics queries, see workspace metadata, and read authorized table data. Its query and workspace reads are control-plane Actions that do not grant row access; its table data read is a DataAction that can be constrained by table- and row-level assignment conditions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 3b03c2da-16b3-4a49-8834-0f8130efdd3b
Control-plane actions (2)
Microsoft.OperationalInsights/workspaces/query/readMicrosoft.OperationalInsights/workspaces/read
Data-plane actions (1)
Microsoft.OperationalInsights/workspaces/tables/data/read
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign at the Log Analytics workspace for the simplest granular RBAC model, then use conditions on the DataAction to limit tables or rows. Without a condition, the DataAction grants data access at the assigned scope; broader assignments are inherited and additive.
Common use cases (2)
- Let a user query only approved Log Analytics tables or rows by applying granular RBAC conditions to the built-in Data Reader role.
- Separate permission to run a query and view metadata in the control plane from permission to read matching log rows in the data plane.
Prerequisites (2)
- Plan the workspace, table, and row attributes that define the allowed data and select the workspace access control mode required by the query context.
- The administrator configuring conditions needs role-assignment write and delete permissions on the workspace, and broader assignments that bypass the restriction must be removed.
Best practices (3)
- Assign at the workspace and put table or row restrictions on the DataAction instead of spreading control and data permissions across broader scopes.
- Review the principal's complete additive role set so a separate broad read assignment does not override the intended restriction.
- Enable and review Log Analytics query auditing to confirm when ABAC conditions apply.
Security considerations (3)
- The control-plane query Action permits running queries and seeing metadata but does not itself authorize access to log rows.
- The table data DataAction grants access to all data at the assigned scope when no condition is present.
- Azure RBAC is additive; a separate higher-access assignment can expose data that a conditional assignment was intended to restrict.
Assignment guidance
Assign Log Analytics Data Reader on the workspace and add the reviewed table- or row-level conditions to its DataAction. Remove conflicting broad read assignments, verify the access control mode for the intended query context, and test both allowed and denied data.
Related roles (2)
- Log Analytics Reader: Broader role that can view all monitoring data and settings in scope rather than acting as the minimum conditional data reader.
- Privileged Monitoring Data Reader: Microsoft documents this separate role for access to protected tables, while Log Analytics Data Reader is the base role for custom granular conditions.
Common questions
When should I assign the Log Analytics Data Reader Azure role?
Assign Log Analytics Data Reader when you need to: Let a user query only approved Log Analytics tables or rows by applying granular RBAC conditions to the built-in Data Reader role.; and Separate permission to run a query and view metadata in the control plane from permission to read matching log rows in the data plane.. Practical scope: Assign at the Log Analytics workspace for the simplest granular RBAC model, then use conditions on the DataAction to limit tables or rows. Without a condition, the DataAction grants data access at the assigned scope; broader assignments are inherited and additive.
What permissions does the Log Analytics Data Reader Azure role grant?
The role definition grants 3 combined control-plane and data-plane actions. Representative operations include: Microsoft.OperationalInsights/workspaces/query/read; Microsoft.OperationalInsights/workspaces/read; and Microsoft.OperationalInsights/workspaces/tables/data/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Log Analytics Data Reader Azure role?
Key considerations when assigning Log Analytics Data Reader: The control-plane query Action permits running queries and seeing metadata but does not itself authorize access to log rows.; The table data DataAction grants access to all data at the assigned scope when no condition is present.; and Azure RBAC is additive; a separate higher-access assignment can expose data that a conditional assignment was intended to restrict.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Monitor →
Supports: Description. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-16.
- Granular RBAC in Azure Monitor →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Manage access to Log Analytics workspaces →
Supports: Description, Practical scope, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.