Azure Analytics built-in role
Schema Registry Reader
Reads and lists Event Hubs Schema Registry groups and retrieves schemas. Reading schema-group resource descriptions is a control-plane Action, while retrieving schemas is a data-plane DataAction.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 2c56ea50-c6b3-40a6-83c0-9d98858bc7d2
Control-plane actions (1)
Microsoft.EventHub/namespaces/schemagroups/read
Data-plane actions (1)
Microsoft.EventHub/namespaces/schemas/read
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Microsoft documents assigning Schema Registry roles to an application security principal at the Event Hubs namespace. A role assigned at resource-group or subscription scope is inherited by every matching namespace below it and broadens schema visibility beyond one registry.
Common use cases (1)
- Allow producer or consumer applications to list schema groups and retrieve registered schemas without changing them.
Prerequisites (2)
- Use an Event Hubs namespace in the Standard, Premium, or Dedicated tier, where Schema Registry is supported.
- For programmatic access, register the application in Microsoft Entra ID and assign its security principal at namespace scope.
Best practices (3)
- Use Schema Registry Reader instead of Contributor when the principal does not create, update, or delete schemas.
- Organize schemas into groups aligned to application or organizational boundaries so unrelated metadata is not shared.
- Keep the assignment on the namespace that contains the required schemas instead of a resource group or subscription.
Security considerations (3)
- Schema metadata can contain business contracts and trade-secret information, and Microsoft identifies schema groups as an authorization boundary that helps prevent leakage.
- The schema DataAction exposes registered schema definitions even though the role cannot modify or delete them.
- A parent-scope assignment is inherited by multiple namespaces and exposes more schema registries than a namespace assignment.
Assignment guidance
Assign Schema Registry Reader to the producer or consumer application security principal at the Event Hubs namespace containing the required schema groups. Use Schema Registry Contributor only for principals that manage schema groups or schema versions.
Related roles (1)
- Schema Registry Contributor: Microsoft documents Schema Registry Contributor for read, write, and delete access to schema groups and schemas.
Common questions
When should I assign the Schema Registry Reader Azure role?
Assign Schema Registry Reader when you need to: Allow producer or consumer applications to list schema groups and retrieve registered schemas without changing them.. Practical scope: Microsoft documents assigning Schema Registry roles to an application security principal at the Event Hubs namespace. A role assigned at resource-group or subscription scope is inherited by every matching namespace below it and broadens schema visibility beyond one registry.
What permissions does the Schema Registry Reader Azure role grant?
The role definition grants 2 combined control-plane and data-plane actions. Representative operations include: Microsoft.EventHub/namespaces/schemagroups/read; and Microsoft.EventHub/namespaces/schemas/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Schema Registry Reader Azure role?
Key considerations when assigning Schema Registry Reader: Schema metadata can contain business contracts and trade-secret information, and Microsoft identifies schema groups as an authorization boundary that helps prevent leakage.; The schema DataAction exposes registered schema definitions even though the role cannot modify or delete them.; and A parent-scope assignment is inherited by multiple namespaces and exposes more schema registries than a namespace assignment.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Analytics →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Schema Registry in Azure Event Hubs →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.