Azure Monitor built-in role
Log Analytics Reader
Views and searches monitoring data and monitoring settings across the assigned scope. The definition has broad control-plane read Actions, explicitly excludes reading workspace shared keys, and also publishes a Log Analytics data-export DataAction.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 73c42c96-874c-492b-b04d-ab87d138a893
Control-plane actions (4)
*/readMicrosoft.OperationalInsights/workspaces/analytics/query/actionMicrosoft.OperationalInsights/workspaces/search/actionMicrosoft.Support/*
Data-plane actions (1)
Microsoft.OperationalInsights/workspaces/jobs/export/action
Excluded actions (1)
Microsoft.OperationalInsights/workspaces/sharedKeys/read
Assignable scopes (1)
/
Practical scope
Assign on a workspace for workspace-context visibility or on a resource, resource group, or subscription for the intended inherited resource-context visibility. The workspace access control mode and query context determine which logs can be queried.
Common use cases (2)
- Inspect Log Analytics data, workspace settings, resource configuration, and diagnostic settings without changing them.
- Support or audit monitoring across an approved scope when granular table- or row-level restrictions are not required.
Prerequisites (2)
- Choose workspace-context or resource-context access and verify the workspace access control mode before assigning the role.
- Confirm that broad resource configuration visibility and the published data-export capability are appropriate for the principal.
Best practices (3)
- Use Log Analytics Data Reader with conditions when access must be limited to specific tables or rows.
- Assign on the workspace or narrow resource scope instead of a subscription when cross-resource visibility is unnecessary.
- Use protected tables or DataActionsOnly mode where control-plane read roles must not implicitly expose sensitive log data.
Security considerations (3)
- The broad read Actions expose Azure resource configuration and monitoring settings throughout the assigned scope.
- The role excludes workspace shared-key reads but still permits querying authorized monitoring data and includes a data-export DataAction.
- Workspace mode, resource permissions, protected-table settings, and other additive assignments all affect the data the principal can see.
Assignment guidance
Assign Log Analytics Reader at the workspace or narrow resource boundary for broad read access. Use Log Analytics Data Reader with conditions for granular data access and review the role's export capability before approval.
Related roles (2)
- Log Analytics Data Reader: Narrower role designed for conditional table- and row-level data access with explicit control/data-plane separation.
- Log Analytics Contributor: Adds workspace, monitoring-settings, extension, and solution management.
Common questions
When should I assign the Log Analytics Reader Azure role?
Assign Log Analytics Reader when you need to: Inspect Log Analytics data, workspace settings, resource configuration, and diagnostic settings without changing them.; and Support or audit monitoring across an approved scope when granular table- or row-level restrictions are not required.. Practical scope: Assign on a workspace for workspace-context visibility or on a resource, resource group, or subscription for the intended inherited resource-context visibility. The workspace access control mode and query context determine which logs can be queried.
What permissions does the Log Analytics Reader Azure role grant?
The role definition grants 5 combined control-plane and data-plane actions. Representative operations include: */read; Microsoft.OperationalInsights/workspaces/analytics/query/action; Microsoft.OperationalInsights/workspaces/search/action; Microsoft.Support/*; and Microsoft.OperationalInsights/workspaces/jobs/export/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Log Analytics Reader Azure role?
Key considerations when assigning Log Analytics Reader: The broad read Actions expose Azure resource configuration and monitoring settings throughout the assigned scope.; The role excludes workspace shared-key reads but still permits querying authorized monitoring data and includes a data-export DataAction.; and Workspace mode, resource permissions, protected-table settings, and other additive assignments all affect the data the principal can see.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Monitor →
Supports: Description, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-16.
- Manage access to Log Analytics workspaces →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Granular RBAC in Azure Monitor →
Supports: Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.