Azure Web and Mobile built-in role

SignalR App Server

Authorizes a Default-mode app server to start server connections, close client connections, and obtain the temporary access key used to sign client tokens during Microsoft Entra-based negotiation. It does not directly create client connections; clients connect with the signed token. These are data-plane permissions only, so the role does not manage the SignalR resource or list its long-lived access keys.

Control-plane actions (0)

None — this role grants no control-plane management actions.

Data-plane actions (3)

• Microsoft.SignalRService/SignalR/auth/accessKey/action
• Microsoft.SignalRService/SignalR/serverConnection/write
• Microsoft.SignalRService/SignalR/clientConnection/write

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign directly on the Azure SignalR Service resource used by the app server. A parent-scope assignment is inherited by every SignalR resource below it, while resource scope confines connection and temporary-key authority to one service instance.

Common use cases (2)

• Run an application server against an Azure SignalR resource in Default mode using Microsoft Entra authorization.
• Start server connections and perform the temporary-key client negotiation flow without distributing the resource connection string, with authority to close a client connection when required.

Prerequisites (2)

• An Azure SignalR Service resource in Default mode and an application or managed identity capable of obtaining a Microsoft Entra OAuth 2.0 token must exist.
• The app server must use a supported SignalR SDK or implement the documented temporary-key and client-token negotiation flow.

Best practices (3)

• Use Microsoft Entra authorization instead of long-lived access keys and assign the role to the app server identity on the individual SignalR resource.
• Refresh the temporary access key before its 90-minute expiration; Microsoft recommends rotating it about once an hour.
• Use SignalR REST API Owner or Reader separately when the workload needs REST management operations beyond app-server connections.

Security considerations (3)

• The role can start server connections, close client connections, and obtain a temporary access key used to sign client tokens, so compromise can disrupt or authorize real-time service access.
• The temporary key expires, but client-token generation remains available while the workload identity retains this assignment.
• A parent-scope assignment permits the app server identity to establish connections against multiple inherited SignalR resources.

Assignment guidance

Assign SignalR App Server to the application or managed identity directly on the Default-mode SignalR resource. Do not add AccessKey Reader for an Entra-based workflow, and use Service Owner only when a Serverless negotiation server genuinely needs both authentication and REST API permissions.

Related roles (2)

• SignalR Service Owner: Adds all SignalR data-plane REST APIs and is documented for negotiation servers in Serverless mode.
• SignalR REST API Owner: Manages connections and groups through REST APIs but does not create server connections or handle negotiation requests.

Editorial sources (7)

• Azure built-in roles for Web and Mobile - Azure RBAC | Microsoft Learn →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Microsoft Entra ID for Azure SignalR Service →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Azure permissions for Web and Mobile - Microsoft.SignalRService →

  Supports: Description, Common use cases, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

Official Microsoft Learn documentation →