Azure Databases built-in role

Azure Managed Redis Reader

Reads Azure Managed Redis resources and configuration without changing them. It cannot retrieve access keys and has no DataActions, so it does not authorize Redis commands or access to cached keys and values.

Control-plane actions (9)

• Microsoft.Authorization/*/read
• Microsoft.Cache/locations/operationsStatus/read
• Microsoft.Cache/operations/read
• Microsoft.Cache/redisEnterprise/read
• Microsoft.Cache/redisEnterprise/*/read
• Microsoft.Insights/alertRules/read
• Microsoft.ResourceHealth/availabilityStatuses/read
• Microsoft.Resources/deployments/read
• Microsoft.Resources/subscriptions/resourceGroups/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the individual Azure Managed Redis resource for one-cache visibility. Resource-group, subscription, or management-group assignments are inherited by all caches below the selected scope. Redis data access remains a separate Microsoft Entra and Redis permissions workflow.

Common use cases (2)

• Inspect cache configuration, deployment state, resource health, metrics, and alert configuration for support or audit work.
• Give monitoring or architecture personnel management-plane visibility without cache modification or cached-data access.

Prerequisites (2)

• The Azure Managed Redis resource must already exist and the principal must only need resource and monitoring visibility.
• Grant a separate Redis user or service-principal permission if the same principal must execute commands against cached data.

Best practices (3)

• Assign at the individual cache when broader resource-group visibility is unnecessary.
• Use this role for support, inventory, and audit before granting Azure Managed Redis Contributor.
• Keep management-plane visibility separate from Redis authentication and data permissions.

Security considerations (3)

• The role exposes cache configuration, deployment, health, metric, alert, and role-assignment metadata.
• It cannot modify Azure Managed Redis resources, retrieve access keys, or access cached data.
• A broad parent-scope assignment exposes configuration for every inherited cache.

Assignment guidance

Assign Azure Managed Redis Reader directly on the cache for view-only support, audit, or monitoring. Add Contributor only for approved infrastructure changes and configure Redis data permissions separately when command or key access is required.

Related roles (1)

• Azure Managed Redis Contributor: Adds cache lifecycle and configuration changes while retaining the separation from Redis data access.

Editorial sources (5)

• Azure built-in roles for Databases →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Manage an Azure Managed Redis cache using the Azure CLI →

  Supports: Common use cases. Retrieved 2026-07-16.

• Secure your Azure Managed Redis deployment →

  Supports: Practical scope, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

Official Microsoft Learn documentation →