Azure Web and Mobile built-in role
Azure Maps Data Contributor
Reads, writes, deletes, and performs other mutable Azure Maps data operations. The role contains DataActions only and no control-plane Actions, so it authorizes Azure Maps REST data-plane requests but does not manage the Azure Maps account resource or Azure role assignments.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 8f5e0ce6-4f7b-4dcf-bddf-e6f48634a204
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (4)
Microsoft.Maps/accounts/*/readMicrosoft.Maps/accounts/*/writeMicrosoft.Maps/accounts/*/deleteMicrosoft.Maps/accounts/*/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign directly on the Azure Maps account whose REST APIs the principal must use. An assignment on a resource group, subscription, or management group is inherited by every Azure Maps account below it; Microsoft generally recommends account scope to avoid unintended access to other map accounts.
Common use cases (2)
- Authorize an application or managed identity to submit Azure Maps batch Search or Route operations that require mutable data-plane access.
- Support an existing Azure Maps workflow that must both read and change map-related data through Microsoft Entra authentication or an RBAC-backed SAS token.
Prerequisites (2)
- An Azure Maps account must exist in a subscription associated with a Microsoft Entra tenant, and the user, group, application, service principal, or managed identity must be identified.
- Confirm that the application actually calls Azure Maps operations that write, delete, or otherwise mutate data; read-only applications should use a reader role or a narrower custom role.
Best practices (3)
- Use Microsoft Entra authentication for production applications when possible and disable local authentication when shared keys and SAS tokens are not required.
- Assign at the individual Azure Maps account and create a custom role when the application needs fewer APIs than this broad mutable-data role grants.
- For SAS-based access, constrain token lifetime, allowed regions, and rate, and rotate to a second managed identity or signing key before revoking the old assignment.
Security considerations (3)
- The role can change and delete Azure Maps data. Microsoft warns that an unintentionally distributed SAS token backed by this role can lead to unauthorized data read or write, sensitive-data exposure, and unexpected costs.
- The built-in role spans many Azure Maps REST APIs and is not automatically least privilege for an application that needs only one mutable operation.
- Removing the managed-identity assignment used by an active SAS token can cause application requests to fail with 401 or 403 responses until access is migrated.
Assignment guidance
Assign Azure Maps Data Contributor to the application identity directly on one Azure Maps account only after verifying that mutable REST operations are required. Use Azure Maps Data Reader, Search and Render Data Reader, or a custom data role for read-only or API-specific workloads, and manage account configuration with a separate control-plane role.
Related roles (2)
- Azure Maps Data Reader: Provides immutable Azure Maps REST API access without the Contributor write and delete data permissions.
- Azure Maps Search and Render Data Reader: Narrows data access to the Search and Render APIs used by common visual web scenarios.
Editorial sources (6)
- Azure built-in roles for Web and Mobile - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Authentication with Azure Maps →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.