Azure Management and governance built-in role
Managed Application Operator Role
Reads Azure resources and invokes actions exposed for Managed Application resources without creating or deleting the Managed Application or managing resource groups. It is control-plane access with no DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: c7393b34-138c-406f-901b-d8cf2b17e6ae
Control-plane actions (3)
*/readMicrosoft.Solutions/applications/readMicrosoft.Solutions/*/action
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Azure RBAC assignments apply at the selected scope and are inherited by child scopes. Keep the assignment at the narrowest resource, resource group, subscription, or management-group boundary that contains the intended resources. Assign on the managed application instance or its dedicated resource group. Because the definition includes broad read access, a parent assignment exposes all inherited resource configuration.
Common use cases (2)
- Run supported operational actions on an existing Managed Application without full lifecycle administration.
- Inspect the Managed Application and its resource state for operations or support.
Prerequisites (2)
- The Managed Application must exist and expose the action required by the operator.
- Confirm that broad configuration read access at the selected scope is appropriate.
Best practices (2)
- Assign directly on the managed application or a dedicated resource group.
- Use Contributor only when create, deployment, or resource-group lifecycle authority is required.
Security considerations (2)
- Supported actions can change application operation even though the role cannot create or delete the Managed Application.
- The wildcard read Action exposes configuration for all resources in scope; the role has no data-plane permissions.
Assignment guidance
Assign to application operators at the managed application resource or dedicated group. Review which actions the application exposes and use Contributor only for approved lifecycle administration.
Related roles (1)
- Managed Application Contributor Role: Adds Managed Application, deployment, and resource-group lifecycle management.
Common questions
When should I assign the Managed Application Operator Role Azure role?
Assign Managed Application Operator Role when you need to: Run supported operational actions on an existing Managed Application without full lifecycle administration.; and Inspect the Managed Application and its resource state for operations or support.. Practical scope: Azure RBAC assignments apply at the selected scope and are inherited by child scopes. Keep the assignment at the narrowest resource, resource group, subscription, or management-group boundary that contains the intended resources. Assign on the managed application instance or its dedicated resource group. Because the definition includes broad read access, a parent assignment exposes all inherited resource configuration.
What permissions does the Managed Application Operator Role Azure role grant?
The role definition grants 3 combined control-plane and data-plane actions. Representative operations include: */read; Microsoft.Solutions/applications/read; and Microsoft.Solutions/*/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Managed Application Operator Role Azure role?
Key considerations when assigning Managed Application Operator Role: Supported actions can change application operation even though the role cannot create or delete the Managed Application.; and The wildcard read Action exposes configuration for all resources in scope; the role has no data-plane permissions.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for Management and governance →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Azure Managed Applications overview →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.