Azure Analytics built-in role
Schema Registry Contributor
Reads, creates, updates, and deletes Event Hubs Schema Registry groups and schemas. Schema-group management is published as control-plane Actions, while schema operations are data-plane DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 5dffeca3-4936-4216-b2bc-10343a5abb25
Control-plane actions (1)
Microsoft.EventHub/namespaces/schemagroups/*
Data-plane actions (1)
Microsoft.EventHub/namespaces/schemas/*
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Microsoft documents assigning Schema Registry roles to an application security principal at the Event Hubs namespace. A role assigned at resource-group or subscription scope is inherited by every matching namespace below it and broadens schema access beyond one registry.
Common use cases (2)
- Let a schema owner register, version, update, and delete schemas and organize them into independently managed schema groups.
- Manage schema compatibility and evolution for producers and consumers that share an Event Hubs namespace.
Prerequisites (3)
- Use an Event Hubs namespace in the Standard, Premium, or Dedicated tier, where Schema Registry is supported.
- For programmatic access, register the application in Microsoft Entra ID and assign its security principal at namespace scope.
- Choose the schema format and schema-group compatibility mode before registering schemas; schema evolution is supported for Avro schemas.
Best practices (3)
- Use separate schema groups for application or organizational boundaries because Microsoft documents a separate authorization model for each group.
- Select and enforce an appropriate compatibility mode so schema updates preserve the intended producer and consumer contract.
- Use Schema Registry Reader for clients that only need to list groups and retrieve schemas.
Security considerations (3)
- Schema groups form an authorization boundary intended to prevent metadata and trade-secret leakage in shared namespace scenarios.
- Contributor can write and delete both schema groups and schemas, so changes can alter or remove the contracts used by producers and consumers.
- A parent-scope assignment is inherited by multiple namespaces and therefore exposes more schema registries than a namespace assignment.
Assignment guidance
Assign Schema Registry Contributor to the schema-management application or team at the Event Hubs namespace that owns the approved schema groups. Keep registries for unrelated applications in separate groups, and assign Schema Registry Reader to principals that only retrieve schemas.
Related roles (1)
- Schema Registry Reader: Microsoft documents Schema Registry Reader for read and list access without schema-group or schema writes and deletes.
Common questions
When should I assign the Schema Registry Contributor Azure role?
Assign Schema Registry Contributor when you need to: Let a schema owner register, version, update, and delete schemas and organize them into independently managed schema groups.; and Manage schema compatibility and evolution for producers and consumers that share an Event Hubs namespace.. Practical scope: Microsoft documents assigning Schema Registry roles to an application security principal at the Event Hubs namespace. A role assigned at resource-group or subscription scope is inherited by every matching namespace below it and broadens schema access beyond one registry.
What permissions does the Schema Registry Contributor Azure role grant?
The role definition grants 2 combined control-plane and data-plane actions. Representative operations include: Microsoft.EventHub/namespaces/schemagroups/*; and Microsoft.EventHub/namespaces/schemas/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Schema Registry Contributor Azure role?
Key considerations when assigning Schema Registry Contributor: Schema groups form an authorization boundary intended to prevent metadata and trade-secret leakage in shared namespace scenarios.; Contributor can write and delete both schema groups and schemas, so changes can alter or remove the contracts used by producers and consumers.; and A parent-scope assignment is inherited by multiple namespaces and therefore exposes more schema registries than a namespace assignment.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Analytics →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Schema Registry in Azure Event Hubs →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.