Azure Web and Mobile built-in role

SignalR/Web PubSub Contributor

Creates, reads, updates, and deletes Azure SignalR Service and Azure Web PubSub resources through control-plane Actions. Its Microsoft.SignalRService/* wildcard also lists and regenerates both services' access keys and restarts either service, with documented downtime. The role definition contains deployment, classic-alert, and support-ticket Actions, but those Actions are effective only when their target resources fall within the assignment scope; support requests require subscription-level access. It has no DataActions and therefore does not directly grant Microsoft Entra data-plane APIs, but listed access keys remain effective service credentials outside the Azure RBAC assignment.

Control-plane actions (6)

• Microsoft.SignalRService/*
• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Resources/deployments/*
• Microsoft.Support/*

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on an existing SignalR or Web PubSub resource only when the operator is authorized for that service's lifecycle and access-key custody, including key listing, regeneration, and restart. That resource assignment does not extend to sibling deployments or classic alert rules. Use a dedicated resource group when the principal must create service resources or manage applicable sibling resources there. Microsoft requires subscription-level access for support requests; do not broaden this service-management role to the subscription merely to provide support access.

Common use cases (2)

• Let a platform engineer create and configure Azure SignalR Service or Azure Web PubSub resources without granting generic Contributor over every resource provider.
• Manage one existing service resource and its child resources while keeping application data-plane authorization separate, or manage multiple service resources in a dedicated resource group.

Prerequisites (2)

• Decide whether the principal manages one existing service resource or creates service and sibling resources in a dedicated resource group, and confirm that the same principal is approved to retrieve, regenerate, and protect the service access keys.
• Inventory applications that use SignalR or Web PubSub access keys before assignment or key regeneration. If local keys remain in use, prepare protected secret storage and a primary/secondary-key rotation procedure; otherwise plan Microsoft Entra data-plane role assignments for the workloads.

Best practices (5)

• Use individual-resource scope for one existing service and a dedicated resource group only when resource creation is required.
• Prefer Microsoft Entra authorization for SignalR and Web PubSub workloads, disable SignalR local authentication when access keys are unnecessary, and grant data-plane roles directly to workload identities.
• For SignalR workloads that still use access keys, store connection strings in Azure Key Vault and never place them in code or plaintext.
• For SignalR and Web PubSub, rotate one access key at a time while the other maintains authenticated connections, then update dependent configurations with the new connection string.
• Use Support Request Contributor at subscription scope for support-ticket duties instead of assigning this broad service-management role across the subscription.

Security considerations (6)

• The Microsoft.SignalRService control-plane wildcard can create, update, delete, and restart SignalR and Web PubSub resources and can view or change their access keys.
• Microsoft describes a SignalR access key as similar to a root password and states that its SDK uses the key to generate a token the service validates. Web PubSub likewise uses a shared access key to generate client tokens.
• Regenerating a key creates a new key and connection string, requiring dependent configurations to be updated; restarting either service has documented downtime.
• A resource-group assignment can also make the role definition's deployment and classic-alert Actions effective against sibling resources in that group, so it is broader than a service-resource assignment.
• A subscription assignment is required before the support-ticket Action can be used and would also extend SignalR and Web PubSub management across the subscription.
• The absence of DataActions means the role does not directly grant Microsoft Entra data-plane APIs; it does not remove the effective service access obtained from a listed access key.

Assignment guidance

Assign SignalR/Web PubSub Contributor directly on an existing resource only to a platform operator trusted to delete or restart the service and to retrieve or regenerate its access keys. If resource management is required without key custody, use a reviewed custom role that omits the listkeys and regeneratekey Actions. Assign Microsoft Entra data-plane roles separately to application identities, Support Request Contributor separately at subscription scope for support duties, and an access-administration role separately for Azure RBAC delegation.

Related roles (2)

• SignalR Service Owner: Provides full SignalR data-plane access but no control-plane management of the service resource.
• Web PubSub Service Owner: Provides full Web PubSub data-plane access but no control-plane management of the service resource.

Editorial sources (12)

• Azure built-in roles for Web and Mobile - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Prerequisites, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Microsoft Entra ID for Azure SignalR Service →

  Supports: Description, Practical scope, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Azure permissions for Web and Mobile - Microsoft.SignalRService →

  Supports: Description, Practical scope, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Connection strings in Azure SignalR Service →

  Supports: Description, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Rotate access keys for Azure SignalR Service →

  Supports: Description, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Authorize access to Web PubSub resources using Microsoft Entra ID →

  Supports: Description, Practical scope, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Rotate access keys for Azure Web PubSub →

  Supports: Description, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Create an Azure support request →

  Supports: Description, Practical scope, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

Official Microsoft Learn documentation →