Azure Monitor built-in role
Monitoring Metrics Publisher
Publishes custom metrics and telemetry for Azure resources. Its supporting resource-group and provider operations are control-plane Actions, while Metrics/Write and Telemetry/Write are data-plane DataActions; it does not grant permission to read the published metrics.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 3913510d-42f4-4e42-8a64-420c390055eb
Control-plane actions (3)
Microsoft.Insights/Register/ActionMicrosoft.Support/*Microsoft.Resources/subscriptions/resourceGroups/read
Data-plane actions (2)
Microsoft.Insights/Metrics/WriteMicrosoft.Insights/Telemetry/Write
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign to the managed identity or service principal at the specific Azure resource whose custom metrics it emits, or at a resource group only when it must publish for multiple contained resources. Custom metrics cannot be emitted against a subscription or resource-group resource ID.
Common use cases (2)
- Allow a managed identity to emit custom metrics about its own Azure resource.
- Allow a service principal or managed identity to publish custom metrics for another approved Azure resource through the Azure Monitor REST API.
Prerequisites (2)
- Use a Microsoft Entra managed identity or service principal and request a token for the https://monitoring.azure.com/ audience.
- Send each metric to the regional Azure Monitor endpoint for the target Azure resource and identify that resource in the request URL.
Best practices (3)
- Prefer a managed identity for an Azure-hosted publisher so no application secret is stored or rotated by the workload.
- Assign at the individual target resource when the publisher emits metrics for only that resource.
- Validate the target resource, region, timestamp, namespace, metric name, and dimensions before publishing.
Security considerations (3)
- The DataActions can write metrics and telemetry that become available to Azure Monitor charts and alerts for the target resource.
- The role does not grant metric read access, so viewing and publishing should remain separate responsibilities where required.
- A resource-group or subscription assignment lets the principal publish against more resources than a resource-scoped assignment.
Assignment guidance
Assign Monitoring Metrics Publisher to the workload identity at each Azure resource it is authorized to represent. Use a broader scope only when the same trusted publisher must emit metrics for every target below that scope.
Related roles (1)
- Monitoring Reader: Microsoft documents a reader or contributor role as separately required to view custom metrics after publication.
Common questions
When should I assign the Monitoring Metrics Publisher Azure role?
Assign Monitoring Metrics Publisher when you need to: Allow a managed identity to emit custom metrics about its own Azure resource.; and Allow a service principal or managed identity to publish custom metrics for another approved Azure resource through the Azure Monitor REST API.. Practical scope: Assign to the managed identity or service principal at the specific Azure resource whose custom metrics it emits, or at a resource group only when it must publish for multiple contained resources. Custom metrics cannot be emitted against a subscription or resource-group resource ID.
What permissions does the Monitoring Metrics Publisher Azure role grant?
The role definition grants 5 combined control-plane and data-plane actions. Representative operations include: Microsoft.Insights/Register/Action; Microsoft.Support/*; Microsoft.Resources/subscriptions/resourceGroups/read; Microsoft.Insights/Metrics/Write; and Microsoft.Insights/Telemetry/Write. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Monitoring Metrics Publisher Azure role?
Key considerations when assigning Monitoring Metrics Publisher: The DataActions can write metrics and telemetry that become available to Azure Monitor charts and alerts for the target resource.; The role does not grant metric read access, so viewing and publishing should remain separate responsibilities where required.; and A resource-group or subscription assignment lets the principal publish against more resources than a resource-scoped assignment.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Monitor →
Supports: Description, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Ingest custom metrics for an Azure resource using the REST API →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.
- Custom metrics in Azure Monitor (preview) →
Supports: Related roles. Retrieved 2026-07-16.