Azure Web and Mobile built-in role
SignalR Service Owner
Provides full access to all Azure SignalR Service data-plane APIs, including REST operations, starting server connections, closing client connections, and temporary key or token generation. It does not directly create client connections; clients connect with generated tokens. The role has no control-plane Actions and does not manage the SignalR resource or Azure role assignments.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 7e4f1700-ea5a-4f59-8f37-079cfe29dce3
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (1)
Microsoft.SignalRService/SignalR/*
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign directly on the Azure SignalR Service resource used by the negotiation server. A parent assignment is inherited by every SignalR resource below it and gives the principal full data-plane access to each inherited instance.
Common use cases (2)
- Run a negotiation server against an Azure SignalR resource in Serverless mode when it needs both REST API and authentication API permissions.
- Support one trusted workload that must manage clients and groups through REST APIs, start server connections, and generate temporary keys or client tokens.
Prerequisites (2)
- An Azure SignalR Service resource in Serverless mode and an application or managed identity capable of obtaining Microsoft Entra tokens must exist.
- Confirm that one workload genuinely requires both REST management and authentication or connection APIs; split responsibilities across narrower roles otherwise.
Best practices (3)
- Reserve this broad data-plane role for the documented Serverless negotiation workflow and assign it on the individual SignalR resource.
- Use App Server in Default mode, REST API Owner for write-capable management without negotiation, and REST API Reader for monitoring.
- Use Microsoft Entra authorization instead of long-lived access keys and review the workload identity regularly.
Security considerations (3)
- The role combines temporary-key and client-token generation, server-connection creation, client-connection closure, broadcasts, and REST management of hubs, groups, users, and client connections.
- Compromise of the assigned workload identity can affect all connected clients and exercise every SignalR data-plane API on the resource.
- Despite the Owner name, the role has no Azure control-plane Actions and cannot assign Azure roles; those permissions require separate access.
Assignment guidance
Assign SignalR Service Owner directly on one Serverless-mode SignalR resource to the negotiation-server identity only after narrower roles are shown to be insufficient. Keep resource management and Azure RBAC delegation on separate control-plane roles.
Related roles (3)
- SignalR App Server: Provides the narrower server-connection and key-generation permissions documented for Default mode.
- SignalR REST API Owner: Provides full REST management without app-server connections or negotiation requests.
- SignalR REST API Reader: Limits access to read-only REST monitoring operations.
Common questions
When should I assign the SignalR Service Owner Azure role?
Assign SignalR Service Owner when you need to: Run a negotiation server against an Azure SignalR resource in Serverless mode when it needs both REST API and authentication API permissions.; and Support one trusted workload that must manage clients and groups through REST APIs, start server connections, and generate temporary keys or client tokens.. Practical scope: Assign directly on the Azure SignalR Service resource used by the negotiation server. A parent assignment is inherited by every SignalR resource below it and gives the principal full data-plane access to each inherited instance.
What permissions does the SignalR Service Owner Azure role grant?
The role definition grants 1 combined control-plane and data-plane actions. Representative operations include: Microsoft.SignalRService/SignalR/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the SignalR Service Owner Azure role?
Key considerations when assigning SignalR Service Owner: The role combines temporary-key and client-token generation, server-connection creation, client-connection closure, broadcasts, and REST management of hubs, groups, users, and client connections.; Compromise of the assigned workload identity can affect all connected clients and exercise every SignalR data-plane API on the resource.; and Despite the Owner name, the role has no Azure control-plane Actions and cannot assign Azure roles; those permissions require separate access.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Web and Mobile - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Microsoft Entra ID for Azure SignalR Service →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Azure permissions for Web and Mobile - Microsoft.SignalRService →
Supports: Description, Common use cases, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.