Azure Web and Mobile built-in role
Azure Maps Search and Render Data Reader
Reads only the Azure Maps Search and Render data APIs used by common visual web SDK scenarios. The role has two DataActions and no control-plane Actions, so it does not manage the Azure Maps account or authorize other Azure Maps service APIs.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 6be48352-4f82-47c9-ad5e-0acacefdb005
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (2)
Microsoft.Maps/accounts/services/render/readMicrosoft.Maps/accounts/services/search/read
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign directly on the Azure Maps account used by the web or mapping application. Assignments at resource-group, subscription, or management-group scope are inherited by other map accounts below them, while an account assignment contains the Search and Render access to one account.
Common use cases (2)
- Render map tiles and perform Azure Maps search operations in a public-facing or interactive web application.
- Authorize a browser-oriented visual map workload without granting the wider immutable API set in Azure Maps Data Reader.
Prerequisites (2)
- An Azure Maps account and a supported Microsoft Entra security principal must exist, and the application must be configured for an Azure Maps authentication flow.
- Confirm that the workload needs only Search and Render APIs; routes, batch operations, or other Azure Maps services require a different built-in or custom role.
Best practices (3)
- Use Microsoft Entra authentication for production applications when possible and assign this role on the individual map account.
- Configure CORS separately for approved browser origins; CORS is not authorization and every request still needs a valid authentication scheme.
- Create an even narrower custom role when the application needs only Render or only Search.
Security considerations (3)
- The role limits Azure Maps data access to Search and Render, but search requests and rendered content can still reveal location or usage information relevant to the application.
- CORS rules do not replace authentication or Azure RBAC, and an overly broad allowed-origin list does not reduce the permissions granted to a valid token.
- A parent-scope assignment gives the same Search and Render access on every inherited Azure Maps account.
Assignment guidance
Assign Azure Maps Search and Render Data Reader to the application identity or approved user group on the one Azure Maps account serving the visual web experience. Move to Data Reader only when additional immutable APIs are documented, to Data Contributor only for mutable operations, or to a custom role for a single-API boundary.
Related roles (2)
- Azure Maps Data Reader: Expands read access from Search and Render to immutable Azure Maps REST APIs generally.
- Azure Maps Data Contributor: Adds mutable Azure Maps REST API access, including write and delete operations.
Common questions
When should I assign the Azure Maps Search and Render Data Reader Azure role?
Assign Azure Maps Search and Render Data Reader when you need to: Render map tiles and perform Azure Maps search operations in a public-facing or interactive web application.; and Authorize a browser-oriented visual map workload without granting the wider immutable API set in Azure Maps Data Reader.. Practical scope: Assign directly on the Azure Maps account used by the web or mapping application. Assignments at resource-group, subscription, or management-group scope are inherited by other map accounts below them, while an account assignment contains the Search and Render access to one account.
What permissions does the Azure Maps Search and Render Data Reader Azure role grant?
The role definition grants 2 combined control-plane and data-plane actions. Representative operations include: Microsoft.Maps/accounts/services/render/read; and Microsoft.Maps/accounts/services/search/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Maps Search and Render Data Reader Azure role?
Key considerations when assigning Azure Maps Search and Render Data Reader: The role limits Azure Maps data access to Search and Render, but search requests and rendered content can still reveal location or usage information relevant to the application.; CORS rules do not replace authentication or Azure RBAC, and an overly broad allowed-origin list does not reduce the permissions granted to a valid token.; and A parent-scope assignment gives the same Search and Render access on every inherited Azure Maps account.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Web and Mobile - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Authentication with Azure Maps →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.