Azure Web and Mobile built-in role
SignalR AccessKey Reader
Reads Azure SignalR Service resource metadata and lists the service access keys through control-plane Actions. The definition also includes support-ticket Actions, but support requests require subscription-level access. It has no DataActions, but the returned keys are credentials that can be used to construct connection strings and authorize service access outside this Azure RBAC assignment.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 04165923-9d83-45d5-8227-78b77b0a687e
Control-plane actions (5)
Microsoft.SignalRService/*/readMicrosoft.SignalRService/SignalR/listkeys/actionMicrosoft.Authorization/*/readMicrosoft.Resources/subscriptions/resourceGroups/readMicrosoft.Support/*
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign directly on the Azure SignalR Service resource whose keys must be read. A parent assignment is inherited by every SignalR resource below it and lets the principal list each resource's keys. Do not broaden this role to subscription scope merely for support-ticket access; use Support Request Contributor separately for that duty.
Common use cases (2)
- Support a tightly controlled legacy deployment or key-rotation process that still must retrieve an Azure SignalR connection string.
- Recover or update an approved integration that cannot yet use Microsoft Entra authorization, while tracking migration away from shared keys.
Prerequisites (2)
- The service owner must document why Microsoft Entra authorization cannot be used and identify the one SignalR resource and secret store involved.
- A secure destination such as Azure Key Vault and a rotation procedure using the primary and secondary keys must be ready before a key is retrieved.
Best practices (3)
- Prefer Microsoft Entra authorization and a data-plane SignalR role instead of distributing access keys whenever possible.
- Store connection strings in Azure Key Vault, never hard-code or save them in plaintext, and rotate keys regularly or immediately after suspected compromise.
- Assign at the individual resource, time-bound human access, remove the role after the legacy integration is migrated, and keep support-ticket access on Support Request Contributor.
Security considerations (4)
- Microsoft describes the access key in a SignalR connection string as similar to a root password for the service.
- Anyone who retrieves a key can use it outside Azure Resource Manager until it is regenerated, so the absence of DataActions in this role does not make key disclosure harmless.
- Regenerating a key invalidates the corresponding connection string and can disrupt applications that have not switched to the alternate key.
- At subscription scope, the support-ticket Action becomes usable and the key-listing permission extends to SignalR resources throughout the subscription.
Assignment guidance
Reserve SignalR AccessKey Reader for a named legacy deployment or rotation identity on one SignalR resource. Place retrieved credentials in a protected secret store, rotate them through the two-key process, and replace the assignment with Microsoft Entra authorization and the appropriate SignalR data role as soon as the application supports it. Assign Support Request Contributor separately at subscription scope when support-ticket access is required.
Related roles (2)
- SignalR App Server: Provides the documented Microsoft Entra data-plane authorization for an app server in Default mode without granting control-plane key listing.
- SignalR Service Owner: Provides broad Microsoft Entra data-plane access, including authentication APIs, without listing the long-lived resource keys through this control-plane role.
Editorial sources (9)
- Azure built-in roles for Web and Mobile - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-17.
- Connection strings in Azure SignalR Service →
Supports: Description, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.
- Rotate access keys for Azure SignalR Service →
Supports: Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.
- Microsoft Entra ID for Azure SignalR Service →
Supports: Prerequisites, Best practices, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Create an Azure support request →
Supports: Description, Practical scope, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.