Azure General built-in role
Reader
Views Azure resource control-plane information at the assigned scope without changing resources. Reader is broad across resource types but read-only in the Azure management plane.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: acdd72a7-3385-48ef-bd42-f606fba81ae7
Control-plane actions (1)
*/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
The built-in definition is available throughout the Azure hierarchy. A Reader assignment applies at the selected management group, subscription, resource group, or resource and is inherited by child scopes. It grants */read in Actions but has no DataActions, so it does not by itself read workload data such as blob contents or secret values.
Common use cases (2)
- Inspect resource configuration and inventory across a defined Azure scope without making changes.
- Give audit, operations, or support personnel control-plane visibility when no service-specific read role is required.
Prerequisites (2)
- Identify the principal that needs visibility and the narrowest scope containing the resources it must inspect.
- The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target scope.
Best practices (3)
- Prefer a service-specific reader role when the principal needs visibility into only one service or resource type.
- Assign at the narrowest practical scope because parent-scope read access is inherited by every child scope.
- Use the immutable role definition ID in scripts and assign groups rather than individual users when practical.
Security considerations (3)
- Read-only access can still expose resource names, configuration, topology, and other control-plane metadata across the assigned scope.
- Reader has no DataActions; grant a separate data-plane role only when the principal must read protected workload data.
- A management-group or subscription assignment creates broad inherited visibility and should be reviewed like any other wide-scope grant.
Assignment guidance
Use Reader for broad control-plane visibility without modification rights. Choose a narrower service-specific reader when available, keep the scope no broader than the inspection task requires, and add a separate data-plane reader only for explicitly approved data access.
Related roles (1)
- Contributor: Adds broad control-plane resource changes when read-only access is insufficient.
Common questions
When should I assign the Reader Azure role?
Assign Reader when you need to: Inspect resource configuration and inventory across a defined Azure scope without making changes.; and Give audit, operations, or support personnel control-plane visibility when no service-specific read role is required.. Practical scope: The built-in definition is available throughout the Azure hierarchy. A Reader assignment applies at the selected management group, subscription, resource group, or resource and is inherited by child scopes. It grants */read in Actions but has no DataActions, so it does not by itself read workload data such as blob contents or secret values.
What permissions does the Reader Azure role grant?
The role definition grants 1 combined control-plane and data-plane actions. Representative operations include: */read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Reader Azure role?
Key considerations when assigning Reader: Read-only access can still expose resource names, configuration, topology, and other control-plane metadata across the assigned scope.; Reader has no DataActions; grant a separate data-plane role only when the principal must read protected workload data.; and A management-group or subscription assignment creates broad inherited visibility and should be reviewed like any other wide-scope grant.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (4)
- Azure built-in roles for General →
Supports: Description, Practical scope, Common use cases, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Common use cases, Prerequisites, Best practices, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.