Azure Web and Mobile built-in role
Azure Maps Data Reader
Reads immutable data through Azure Maps REST APIs. The role contains DataActions only and no control-plane Actions, so it authorizes Azure Maps data-plane requests but cannot modify map data, manage the Azure Maps account, or create Azure role assignments.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 423170ca-a8f6-4b0f-8487-9e4eb8f49bfa
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (1)
Microsoft.Maps/accounts/*/read
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign directly on the Azure Maps account whose immutable REST APIs the principal must call. A parent-scope assignment is inherited by all Azure Maps accounts below it; Microsoft generally recommends account scope to prevent unintended access to other map accounts.
Common use cases (2)
- Authorize a trusted application, managed identity, user, or group to call multiple immutable Azure Maps REST APIs without granting mutable data operations.
- Back a read-only Azure Maps SAS token or Microsoft Entra application workflow that needs more APIs than Search and Render alone.
Prerequisites (2)
- An Azure Maps account must exist in a subscription associated with a Microsoft Entra tenant, and the intended security principal must be available for assignment.
- Inventory the REST APIs the workload calls and verify that they are immutable operations; use a custom role if the required API set is narrower than this built-in reader.
Best practices (3)
- Prefer Microsoft Entra authentication for production applications and disable local authentication when shared keys and SAS tokens are unnecessary.
- Assign on the individual map account and use Search and Render Data Reader or a custom role when the workload needs fewer APIs.
- For user access, assign groups rather than maintaining equivalent individual assignments.
Security considerations (3)
- Read-only does not mean low sensitivity: the role can expose data returned by many Azure Maps REST APIs across the assigned account.
- The built-in role is broader than a workload that needs only map rendering or one search operation, so it should not be described as least privilege without comparing the actual API set.
- A parent-scope assignment exposes every inherited Azure Maps account to the principal.
Assignment guidance
Assign Azure Maps Data Reader to the workload identity or user group directly on one Azure Maps account after verifying that only immutable APIs are required. Use Search and Render Data Reader for the documented basic web-map scenario, a custom role for a smaller API set, and Data Contributor only when mutable operations are required.
Related roles (2)
- Azure Maps Search and Render Data Reader: Provides a smaller documented data-plane boundary for Search and Render APIs only.
- Azure Maps Data Contributor: Adds write, delete, and other mutable Azure Maps data operations.
Common questions
When should I assign the Azure Maps Data Reader Azure role?
Assign Azure Maps Data Reader when you need to: Authorize a trusted application, managed identity, user, or group to call multiple immutable Azure Maps REST APIs without granting mutable data operations.; and Back a read-only Azure Maps SAS token or Microsoft Entra application workflow that needs more APIs than Search and Render alone.. Practical scope: Assign directly on the Azure Maps account whose immutable REST APIs the principal must call. A parent-scope assignment is inherited by all Azure Maps accounts below it; Microsoft generally recommends account scope to prevent unintended access to other map accounts.
What permissions does the Azure Maps Data Reader Azure role grant?
The role definition grants 1 combined control-plane and data-plane actions. Representative operations include: Microsoft.Maps/accounts/*/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Maps Data Reader Azure role?
Key considerations when assigning Azure Maps Data Reader: Read-only does not mean low sensitivity: the role can expose data returned by many Azure Maps REST APIs across the assigned account.; The built-in role is broader than a workload that needs only map rendering or one search operation, so it should not be described as least privilege without comparing the actual API set.; and A parent-scope assignment exposes every inherited Azure Maps account to the principal.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Web and Mobile - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Authentication with Azure Maps →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.