Azure Web and Mobile built-in role
SignalR App Server
Authorizes a Default-mode app server to start server connections, close client connections, and obtain the temporary access key used to sign client tokens during Microsoft Entra-based negotiation. It does not directly create client connections; clients connect with the signed token. These are data-plane permissions only, so the role does not manage the SignalR resource or list its long-lived access keys.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 420fcaa2-552c-430f-98ca-3264be4806c7
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (3)
Microsoft.SignalRService/SignalR/auth/accessKey/actionMicrosoft.SignalRService/SignalR/serverConnection/writeMicrosoft.SignalRService/SignalR/clientConnection/write
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign directly on the Azure SignalR Service resource used by the app server. A parent-scope assignment is inherited by every SignalR resource below it, while resource scope confines connection and temporary-key authority to one service instance.
Common use cases (2)
- Run an application server against an Azure SignalR resource in Default mode using Microsoft Entra authorization.
- Start server connections and perform the temporary-key client negotiation flow without distributing the resource connection string, with authority to close a client connection when required.
Prerequisites (2)
- An Azure SignalR Service resource in Default mode and an application or managed identity capable of obtaining a Microsoft Entra OAuth 2.0 token must exist.
- The app server must use a supported SignalR SDK or implement the documented temporary-key and client-token negotiation flow.
Best practices (3)
- Use Microsoft Entra authorization instead of long-lived access keys and assign the role to the app server identity on the individual SignalR resource.
- Refresh the temporary access key before its 90-minute expiration; Microsoft recommends rotating it about once an hour.
- Use SignalR REST API Owner or Reader separately when the workload needs REST management operations beyond app-server connections.
Security considerations (3)
- The role can start server connections, close client connections, and obtain a temporary access key used to sign client tokens, so compromise can disrupt or authorize real-time service access.
- The temporary key expires, but client-token generation remains available while the workload identity retains this assignment.
- A parent-scope assignment permits the app server identity to establish connections against multiple inherited SignalR resources.
Assignment guidance
Assign SignalR App Server to the application or managed identity directly on the Default-mode SignalR resource. Do not add AccessKey Reader for an Entra-based workflow, and use Service Owner only when a Serverless negotiation server genuinely needs both authentication and REST API permissions.
Related roles (2)
- SignalR Service Owner: Adds all SignalR data-plane REST APIs and is documented for negotiation servers in Serverless mode.
- SignalR REST API Owner: Manages connections and groups through REST APIs but does not create server connections or handle negotiation requests.
Common questions
When should I assign the SignalR App Server Azure role?
Assign SignalR App Server when you need to: Run an application server against an Azure SignalR resource in Default mode using Microsoft Entra authorization.; and Start server connections and perform the temporary-key client negotiation flow without distributing the resource connection string, with authority to close a client connection when required.. Practical scope: Assign directly on the Azure SignalR Service resource used by the app server. A parent-scope assignment is inherited by every SignalR resource below it, while resource scope confines connection and temporary-key authority to one service instance.
What permissions does the SignalR App Server Azure role grant?
The role definition grants 3 combined control-plane and data-plane actions. Representative operations include: Microsoft.SignalRService/SignalR/auth/accessKey/action; Microsoft.SignalRService/SignalR/serverConnection/write; and Microsoft.SignalRService/SignalR/clientConnection/write. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the SignalR App Server Azure role?
Key considerations when assigning SignalR App Server: The role can start server connections, close client connections, and obtain a temporary access key used to sign client tokens, so compromise can disrupt or authorize real-time service access.; The temporary key expires, but client-token generation remains available while the workload identity retains this assignment.; and A parent-scope assignment permits the app server identity to establish connections against multiple inherited SignalR resources.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Web and Mobile - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Microsoft Entra ID for Azure SignalR Service →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Azure permissions for Web and Mobile - Microsoft.SignalRService →
Supports: Description, Common use cases, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.