Azure Monitor built-in role

Log Analytics Reader

Views and searches monitoring data and monitoring settings across the assigned scope. The definition has broad control-plane read Actions, explicitly excludes reading workspace shared keys, and also publishes a Log Analytics data-export DataAction.

Control-plane actions (4)

• */read
• Microsoft.OperationalInsights/workspaces/analytics/query/action
• Microsoft.OperationalInsights/workspaces/search/action
• Microsoft.Support/*

Data-plane actions (1)

• Microsoft.OperationalInsights/workspaces/jobs/export/action

Excluded actions (1)

• Microsoft.OperationalInsights/workspaces/sharedKeys/read

Assignable scopes (1)

• /

Practical scope

Assign on a workspace for workspace-context visibility or on a resource, resource group, or subscription for the intended inherited resource-context visibility. The workspace access control mode and query context determine which logs can be queried.

Common use cases (2)

• Inspect Log Analytics data, workspace settings, resource configuration, and diagnostic settings without changing them.
• Support or audit monitoring across an approved scope when granular table- or row-level restrictions are not required.

Prerequisites (2)

• Choose workspace-context or resource-context access and verify the workspace access control mode before assigning the role.
• Confirm that broad resource configuration visibility and the published data-export capability are appropriate for the principal.

Best practices (3)

• Use Log Analytics Data Reader with conditions when access must be limited to specific tables or rows.
• Assign on the workspace or narrow resource scope instead of a subscription when cross-resource visibility is unnecessary.
• Use protected tables or DataActionsOnly mode where control-plane read roles must not implicitly expose sensitive log data.

Security considerations (3)

• The broad read Actions expose Azure resource configuration and monitoring settings throughout the assigned scope.
• The role excludes workspace shared-key reads but still permits querying authorized monitoring data and includes a data-export DataAction.
• Workspace mode, resource permissions, protected-table settings, and other additive assignments all affect the data the principal can see.

Assignment guidance

Assign Log Analytics Reader at the workspace or narrow resource boundary for broad read access. Use Log Analytics Data Reader with conditions for granular data access and review the role's export capability before approval.

Related roles (2)

• Log Analytics Data Reader: Narrower role designed for conditional table- and row-level data access with explicit control/data-plane separation.
• Log Analytics Contributor: Adds workspace, monitoring-settings, extension, and solution management.

Editorial sources (6)

• Azure built-in roles for Monitor →

  Supports: Description, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Manage access to Log Analytics workspaces →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Granular RBAC in Azure Monitor →

  Supports: Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →