Azure Web and Mobile built-in role
SignalR REST API Owner
Provides full access to the Azure SignalR data-plane REST APIs for hubs, groups, users, and client connections, including client-token generation. It has no control-plane Actions and does not create app-server connections or provide the app-server negotiation workflow.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: fd53cd77-2268-407a-8f46-7e7863d0f521
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (5)
Microsoft.SignalRService/SignalR/auth/clientToken/actionMicrosoft.SignalRService/SignalR/hub/*Microsoft.SignalRService/SignalR/group/*Microsoft.SignalRService/SignalR/clientConnection/*Microsoft.SignalRService/SignalR/user/*
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign directly on the Azure SignalR Service resource whose clients and groups the principal manages. A resource-group, subscription, or management-group assignment is inherited by every SignalR resource below it.
Common use cases (2)
- Use the Azure SignalR Management SDK from a console app, function, or web server to broadcast messages and manage connected clients and groups.
- Operate SignalR data-plane REST APIs without granting server-connection creation required by a Default-mode app server.
Prerequisites (2)
- An Azure SignalR Service resource and an application or managed identity capable of obtaining a Microsoft Entra token must exist.
- The workload must require write-capable REST management of hubs, groups, users, or client connections but not app-server connection creation.
Best practices (3)
- Assign on the individual SignalR resource and use REST API Reader for a monitoring workload that only calls read-only APIs.
- Use Microsoft Entra authorization rather than connection strings and keep the workload identity credentials out of code.
- Separate REST management from app-server or Serverless negotiation authority unless one workload demonstrably needs both.
Security considerations (3)
- The role can generate client tokens and perform write operations affecting hubs, groups, users, and client connections, including broadcasts and connection management.
- It does not create server connections, but its REST authority can still affect all connected clients within the assigned SignalR resource.
- A broader assignment gives the same REST control over every inherited SignalR resource.
Assignment guidance
Assign SignalR REST API Owner to the management application identity directly on one SignalR resource. Use REST API Reader for monitoring, App Server for Default-mode server connections, and Service Owner only for the documented Serverless negotiation workflow that needs both REST and authentication APIs.
Related roles (3)
- SignalR REST API Reader: Provides read-only access to the documented SignalR REST monitoring APIs.
- SignalR Service Owner: Adds server-connection and authentication APIs to the REST API permissions.
- SignalR App Server: Provides server-connection and key-generation APIs without full REST API management.
Common questions
When should I assign the SignalR REST API Owner Azure role?
Assign SignalR REST API Owner when you need to: Use the Azure SignalR Management SDK from a console app, function, or web server to broadcast messages and manage connected clients and groups.; and Operate SignalR data-plane REST APIs without granting server-connection creation required by a Default-mode app server.. Practical scope: Assign directly on the Azure SignalR Service resource whose clients and groups the principal manages. A resource-group, subscription, or management-group assignment is inherited by every SignalR resource below it.
What permissions does the SignalR REST API Owner Azure role grant?
The role definition grants 5 combined control-plane and data-plane actions. Representative operations include: Microsoft.SignalRService/SignalR/auth/clientToken/action; Microsoft.SignalRService/SignalR/hub/*; Microsoft.SignalRService/SignalR/group/*; Microsoft.SignalRService/SignalR/clientConnection/*; and Microsoft.SignalRService/SignalR/user/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the SignalR REST API Owner Azure role?
Key considerations when assigning SignalR REST API Owner: The role can generate client tokens and perform write operations affecting hubs, groups, users, and client connections, including broadcasts and connection management.; It does not create server connections, but its REST authority can still affect all connected clients within the assigned SignalR resource.; and A broader assignment gives the same REST control over every inherited SignalR resource.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Web and Mobile - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Microsoft Entra ID for Azure SignalR Service →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.