Azure Web and Mobile built-in role

SignalR REST API Owner

Provides full access to the Azure SignalR data-plane REST APIs for hubs, groups, users, and client connections, including client-token generation. It has no control-plane Actions and does not create app-server connections or provide the app-server negotiation workflow.

Control-plane actions (0)

None — this role grants no control-plane management actions.

Data-plane actions (5)

• Microsoft.SignalRService/SignalR/auth/clientToken/action
• Microsoft.SignalRService/SignalR/hub/*
• Microsoft.SignalRService/SignalR/group/*
• Microsoft.SignalRService/SignalR/clientConnection/*
• Microsoft.SignalRService/SignalR/user/*

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign directly on the Azure SignalR Service resource whose clients and groups the principal manages. A resource-group, subscription, or management-group assignment is inherited by every SignalR resource below it.

Common use cases (2)

• Use the Azure SignalR Management SDK from a console app, function, or web server to broadcast messages and manage connected clients and groups.
• Operate SignalR data-plane REST APIs without granting server-connection creation required by a Default-mode app server.

Prerequisites (2)

• An Azure SignalR Service resource and an application or managed identity capable of obtaining a Microsoft Entra token must exist.
• The workload must require write-capable REST management of hubs, groups, users, or client connections but not app-server connection creation.

Best practices (3)

• Assign on the individual SignalR resource and use REST API Reader for a monitoring workload that only calls read-only APIs.
• Use Microsoft Entra authorization rather than connection strings and keep the workload identity credentials out of code.
• Separate REST management from app-server or Serverless negotiation authority unless one workload demonstrably needs both.

Security considerations (3)

• The role can generate client tokens and perform write operations affecting hubs, groups, users, and client connections, including broadcasts and connection management.
• It does not create server connections, but its REST authority can still affect all connected clients within the assigned SignalR resource.
• A broader assignment gives the same REST control over every inherited SignalR resource.

Assignment guidance

Assign SignalR REST API Owner to the management application identity directly on one SignalR resource. Use REST API Reader for monitoring, App Server for Default-mode server connections, and Service Owner only for the documented Serverless negotiation workflow that needs both REST and authentication APIs.

Related roles (3)

• SignalR REST API Reader: Provides read-only access to the documented SignalR REST monitoring APIs.
• SignalR Service Owner: Adds server-connection and authentication APIs to the REST API permissions.
• SignalR App Server: Provides server-connection and key-generation APIs without full REST API management.

Editorial sources (6)

• Azure built-in roles for Web and Mobile - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Microsoft Entra ID for Azure SignalR Service →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →