Azure Databases built-in role
Azure Managed Redis Reader
Reads Azure Managed Redis resources and configuration without changing them. It cannot retrieve access keys and has no DataActions, so it does not authorize Redis commands or access to cached keys and values.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: f287ba2f-f923-4464-a5bd-721c3951d32d
Control-plane actions (9)
Microsoft.Authorization/*/readMicrosoft.Cache/locations/operationsStatus/readMicrosoft.Cache/operations/readMicrosoft.Cache/redisEnterprise/readMicrosoft.Cache/redisEnterprise/*/readMicrosoft.Insights/alertRules/readMicrosoft.ResourceHealth/availabilityStatuses/readMicrosoft.Resources/deployments/readMicrosoft.Resources/subscriptions/resourceGroups/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual Azure Managed Redis resource for one-cache visibility. Resource-group, subscription, or management-group assignments are inherited by all caches below the selected scope. Redis data access remains a separate Microsoft Entra and Redis permissions workflow.
Common use cases (2)
- Inspect cache configuration, deployment state, resource health, metrics, and alert configuration for support or audit work.
- Give monitoring or architecture personnel management-plane visibility without cache modification or cached-data access.
Prerequisites (2)
- The Azure Managed Redis resource must already exist and the principal must only need resource and monitoring visibility.
- Grant a separate Redis user or service-principal permission if the same principal must execute commands against cached data.
Best practices (3)
- Assign at the individual cache when broader resource-group visibility is unnecessary.
- Use this role for support, inventory, and audit before granting Azure Managed Redis Contributor.
- Keep management-plane visibility separate from Redis authentication and data permissions.
Security considerations (3)
- The role exposes cache configuration, deployment, health, metric, alert, and role-assignment metadata.
- It cannot modify Azure Managed Redis resources, retrieve access keys, or access cached data.
- A broad parent-scope assignment exposes configuration for every inherited cache.
Assignment guidance
Assign Azure Managed Redis Reader directly on the cache for view-only support, audit, or monitoring. Add Contributor only for approved infrastructure changes and configure Redis data permissions separately when command or key access is required.
Related roles (1)
- Azure Managed Redis Contributor: Adds cache lifecycle and configuration changes while retaining the separation from Redis data access.
Common questions
When should I assign the Azure Managed Redis Reader Azure role?
Assign Azure Managed Redis Reader when you need to: Inspect cache configuration, deployment state, resource health, metrics, and alert configuration for support or audit work.; and Give monitoring or architecture personnel management-plane visibility without cache modification or cached-data access.. Practical scope: Assign on the individual Azure Managed Redis resource for one-cache visibility. Resource-group, subscription, or management-group assignments are inherited by all caches below the selected scope. Redis data access remains a separate Microsoft Entra and Redis permissions workflow.
What permissions does the Azure Managed Redis Reader Azure role grant?
The role definition grants 9 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Cache/locations/operationsStatus/read; Microsoft.Cache/operations/read; Microsoft.Cache/redisEnterprise/read; Microsoft.Cache/redisEnterprise/*/read; and Microsoft.Insights/alertRules/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Managed Redis Reader Azure role?
Key considerations when assigning Azure Managed Redis Reader: The role exposes cache configuration, deployment, health, metric, alert, and role-assignment metadata.; It cannot modify Azure Managed Redis resources, retrieve access keys, or access cached data.; and A broad parent-scope assignment exposes configuration for every inherited cache.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for Databases →
Supports: Description, Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-16.
- Manage an Azure Managed Redis cache using the Azure CLI →
Supports: Common use cases. Retrieved 2026-07-16.
- Secure your Azure Managed Redis deployment →
Supports: Practical scope, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.