Azure Web and Mobile built-in role

SignalR AccessKey Reader

Reads Azure SignalR Service resource metadata and lists the service access keys through control-plane Actions. The definition also includes support-ticket Actions, but support requests require subscription-level access. It has no DataActions, but the returned keys are credentials that can be used to construct connection strings and authorize service access outside this Azure RBAC assignment.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: 04165923-9d83-45d5-8227-78b77b0a687e

Control-plane actions (5)

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

Assign directly on the Azure SignalR Service resource whose keys must be read. A parent assignment is inherited by every SignalR resource below it and lets the principal list each resource's keys. Do not broaden this role to subscription scope merely for support-ticket access; use Support Request Contributor separately for that duty.

Common use cases (2)

Prerequisites (2)

Best practices (3)

Security considerations (4)

Assignment guidance

Reserve SignalR AccessKey Reader for a named legacy deployment or rotation identity on one SignalR resource. Place retrieved credentials in a protected secret store, rotate them through the two-key process, and replace the assignment with Microsoft Entra authorization and the appropriate SignalR data role as soon as the application supports it. Assign Support Request Contributor separately at subscription scope when support-ticket access is required.

Related roles (2)

Common questions

When should I assign the SignalR AccessKey Reader Azure role?

Assign SignalR AccessKey Reader when you need to: Support a tightly controlled legacy deployment or key-rotation process that still must retrieve an Azure SignalR connection string.; and Recover or update an approved integration that cannot yet use Microsoft Entra authorization, while tracking migration away from shared keys.. Practical scope: Assign directly on the Azure SignalR Service resource whose keys must be read. A parent assignment is inherited by every SignalR resource below it and lets the principal list each resource's keys. Do not broaden this role to subscription scope merely for support-ticket access; use Support Request Contributor separately for that duty.

What permissions does the SignalR AccessKey Reader Azure role grant?

The role definition grants 5 combined control-plane and data-plane actions. Representative operations include: Microsoft.SignalRService/*/read; Microsoft.SignalRService/SignalR/listkeys/action; Microsoft.Authorization/*/read; Microsoft.Resources/subscriptions/resourceGroups/read; and Microsoft.Support/*. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the SignalR AccessKey Reader Azure role?

Key considerations when assigning SignalR AccessKey Reader: Microsoft describes the access key in a SignalR connection string as similar to a root password for the service.; Anyone who retrieves a key can use it outside Azure Resource Manager until it is regenerated, so the absence of DataActions in this role does not make key disclosure harmless.; Regenerating a key invalidates the corresponding connection string and can disrupt applications that have not switched to the alternate key.; and At subscription scope, the support-ticket Action becomes usable and the key-listing permission extends to SignalR resources throughout the subscription.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (9)

Official Microsoft Learn documentation →