Azure Analytics built-in role

Schema Registry Reader

Reads and lists Event Hubs Schema Registry groups and retrieves schemas. Reading schema-group resource descriptions is a control-plane Action, while retrieving schemas is a data-plane DataAction.

Control-plane actions (1)

• Microsoft.EventHub/namespaces/schemagroups/read

Data-plane actions (1)

• Microsoft.EventHub/namespaces/schemas/read

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Microsoft documents assigning Schema Registry roles to an application security principal at the Event Hubs namespace. A role assigned at resource-group or subscription scope is inherited by every matching namespace below it and broadens schema visibility beyond one registry.

Common use cases (1)

• Allow producer or consumer applications to list schema groups and retrieve registered schemas without changing them.

Prerequisites (2)

• Use an Event Hubs namespace in the Standard, Premium, or Dedicated tier, where Schema Registry is supported.
• For programmatic access, register the application in Microsoft Entra ID and assign its security principal at namespace scope.

Best practices (3)

• Use Schema Registry Reader instead of Contributor when the principal does not create, update, or delete schemas.
• Organize schemas into groups aligned to application or organizational boundaries so unrelated metadata is not shared.
• Keep the assignment on the namespace that contains the required schemas instead of a resource group or subscription.

Security considerations (3)

• Schema metadata can contain business contracts and trade-secret information, and Microsoft identifies schema groups as an authorization boundary that helps prevent leakage.
• The schema DataAction exposes registered schema definitions even though the role cannot modify or delete them.
• A parent-scope assignment is inherited by multiple namespaces and exposes more schema registries than a namespace assignment.

Assignment guidance

Assign Schema Registry Reader to the producer or consumer application security principal at the Event Hubs namespace containing the required schema groups. Use Schema Registry Contributor only for principals that manage schema groups or schema versions.

Related roles (1)

• Schema Registry Contributor: Microsoft documents Schema Registry Contributor for read, write, and delete access to schema groups and schemas.

Editorial sources (6)

• Azure built-in roles for Analytics →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Schema Registry in Azure Event Hubs →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →