Azure Web and Mobile built-in role

SignalR Service Owner

Provides full access to all Azure SignalR Service data-plane APIs, including REST operations, starting server connections, closing client connections, and temporary key or token generation. It does not directly create client connections; clients connect with generated tokens. The role has no control-plane Actions and does not manage the SignalR resource or Azure role assignments.

Control-plane actions (0)

None — this role grants no control-plane management actions.

Data-plane actions (1)

• Microsoft.SignalRService/SignalR/*

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign directly on the Azure SignalR Service resource used by the negotiation server. A parent assignment is inherited by every SignalR resource below it and gives the principal full data-plane access to each inherited instance.

Common use cases (2)

• Run a negotiation server against an Azure SignalR resource in Serverless mode when it needs both REST API and authentication API permissions.
• Support one trusted workload that must manage clients and groups through REST APIs, start server connections, and generate temporary keys or client tokens.

Prerequisites (2)

• An Azure SignalR Service resource in Serverless mode and an application or managed identity capable of obtaining Microsoft Entra tokens must exist.
• Confirm that one workload genuinely requires both REST management and authentication or connection APIs; split responsibilities across narrower roles otherwise.

Best practices (3)

• Reserve this broad data-plane role for the documented Serverless negotiation workflow and assign it on the individual SignalR resource.
• Use App Server in Default mode, REST API Owner for write-capable management without negotiation, and REST API Reader for monitoring.
• Use Microsoft Entra authorization instead of long-lived access keys and review the workload identity regularly.

Security considerations (3)

• The role combines temporary-key and client-token generation, server-connection creation, client-connection closure, broadcasts, and REST management of hubs, groups, users, and client connections.
• Compromise of the assigned workload identity can affect all connected clients and exercise every SignalR data-plane API on the resource.
• Despite the Owner name, the role has no Azure control-plane Actions and cannot assign Azure roles; those permissions require separate access.

Assignment guidance

Assign SignalR Service Owner directly on one Serverless-mode SignalR resource to the negotiation-server identity only after narrower roles are shown to be insufficient. Keep resource management and Azure RBAC delegation on separate control-plane roles.

Related roles (3)

• SignalR App Server: Provides the narrower server-connection and key-generation permissions documented for Default mode.
• SignalR REST API Owner: Provides full REST management without app-server connections or negotiation requests.
• SignalR REST API Reader: Limits access to read-only REST monitoring operations.

Editorial sources (7)

• Azure built-in roles for Web and Mobile - Azure RBAC | Microsoft Learn →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Microsoft Entra ID for Azure SignalR Service →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Azure permissions for Web and Mobile - Microsoft.SignalRService →

  Supports: Description, Common use cases, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

Official Microsoft Learn documentation →