Azure Web and Mobile built-in role
Azure Spring Apps Remote Debugging Role
Attaches a remote debugger to an Azure Spring Apps application deployment through a data-plane remote-debugging action. The role has no control-plane Actions. Azure Spring Apps disables remote debugging by default and retires on March 31, 2028.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: a99b0159-1064-4c22-a57b-c9b3caa1c054
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (1)
Microsoft.AppPlatform/Spring/apps/deployments/remotedebugging/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Microsoft documents assignment on the existing Azure Spring Apps service instance. The assignment enables remote-debug connections to deployments in that instance; broader parent assignments are inherited by additional service instances and should be avoided.
Common use cases (2)
- Attach IntelliJ IDEA or Visual Studio Code to a supported Java app instance to investigate a defect that cannot be resolved from logs or managed diagnostics.
- Perform a tightly controlled final debugging session needed to stabilize an existing workload during migration from Azure Spring Apps.
Prerequisites (2)
- A Java application must already be deployed using a supported JAR, source-code, or Enterprise Java application deployment; custom-image deployments are not supported.
- Remote debugging must be explicitly enabled with an approved port, the current Azure Spring Apps extension and supported IDE tooling must be available, and company policy must permit the session.
Best practices (3)
- Scale the app to one instance for the session, enable remote debugging only when needed, and disable it immediately afterward.
- Assign the role directly on the service instance for a short window and remove the assignment when debugging finishes.
- Prefer logs and managed diagnostics first, and migrate the workload before the March 31, 2028 retirement date.
Security considerations (3)
- Microsoft explicitly warns that Java remote debugging is dangerous because it permits remote code execution in the application process.
- A debugger can inspect memory, variables, execution flow, and secrets available to the process and can alter runtime behavior.
- Leaving either remote debugging or the RBAC assignment enabled after the session extends unnecessary code-execution exposure.
Assignment guidance
Grant Azure Spring Apps Remote Debugging Role directly on the existing service instance to the named developer or incident responder only for an approved Java debugging session. Enable the endpoint just before use, then disable remote debugging and remove the assignment as soon as the session ends.
Common questions
When should I assign the Azure Spring Apps Remote Debugging Role Azure role?
Assign Azure Spring Apps Remote Debugging Role when you need to: Attach IntelliJ IDEA or Visual Studio Code to a supported Java app instance to investigate a defect that cannot be resolved from logs or managed diagnostics.; and Perform a tightly controlled final debugging session needed to stabilize an existing workload during migration from Azure Spring Apps.. Practical scope: Microsoft documents assignment on the existing Azure Spring Apps service instance. The assignment enables remote-debug connections to deployments in that instance; broader parent assignments are inherited by additional service instances and should be avoided.
What permissions does the Azure Spring Apps Remote Debugging Role Azure role grant?
The role definition grants 1 combined control-plane and data-plane actions. Representative operations include: Microsoft.AppPlatform/Spring/apps/deployments/remotedebugging/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Spring Apps Remote Debugging Role Azure role?
Key considerations when assigning Azure Spring Apps Remote Debugging Role: Microsoft explicitly warns that Java remote debugging is dangerous because it permits remote code execution in the application process.; A debugger can inspect memory, variables, execution flow, and secrets available to the process and can alter runtime behavior.; and Leaving either remote debugging or the RBAC assignment enabled after the session extends unnecessary code-execution exposure.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Web and Mobile - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Debug your apps remotely in Azure Spring Apps →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.
- Azure Spring Apps retirement announcement →
Supports: Description, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.