Azure Web and Mobile built-in role

Azure Spring Cloud Config Server Contributor

Reads, writes, and deletes content in the managed Spring Cloud Config Server through DataActions only. It does not manage the Azure Spring Apps resource through the control plane. Azure Spring Apps Basic, Standard, and Enterprise plans retire on March 31, 2028.

Control-plane actions (0)

None — this role grants no control-plane management actions.

Data-plane actions (3)

• Microsoft.AppPlatform/Spring/configService/read
• Microsoft.AppPlatform/Spring/configService/write
• Microsoft.AppPlatform/Spring/configService/delete

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the existing Azure Spring Apps service instance whose managed Config Server the principal must access. A parent-scope assignment is inherited by Config Servers in additional Spring Apps instances, so service-instance scope is the practical boundary for one retiring deployment.

Common use cases (2)

• Let an external application, migration tool, user, service principal, or managed identity read and change managed Config Server content through Microsoft Entra token authentication.
• Update or remove configuration content during a controlled migration from an existing Basic or Standard Azure Spring Apps instance.

Prerequisites (2)

• An existing Basic or Standard Azure Spring Apps instance must expose the managed Config Server endpoint; applications running inside the service normally use platform-managed certificate authentication and do not need this assignment.
• The external principal must be able to obtain a Microsoft Entra access token and the change workflow must be tied to an approved remaining operational or migration need.

Best practices (3)

• Use Config Server Reader when the principal does not need to change or delete configuration content.
• Assign directly on the service instance, protect service-principal credentials, and remove access after the external or migration workflow ends.
• Migrate configuration to Azure Container Apps, AKS, or another supported platform before March 31, 2028.

Security considerations (3)

• The role can alter or delete centralized configuration consumed by distributed applications, which can disrupt workloads or change their runtime behavior.
• Configuration content can contain sensitive operational values, and the role grants both read and mutation authority over that data plane.
• A parent-scope assignment extends Config Server mutation authority to every inherited Azure Spring Apps instance.

Assignment guidance

For an existing external Config Server workflow, assign the Contributor directly on the Azure Spring Apps service instance to the application or migration identity that must change content. Use Reader for inspection-only access, document the migration deadline, and remove the assignment when the dependency is retired.

Related roles (1)

• Azure Spring Cloud Config Server Reader: Provides read access to managed Config Server content without write or delete DataActions.

Editorial sources (7)

• Azure built-in roles for Web and Mobile - Azure RBAC | Microsoft Learn →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Access Config Server and Service Registry →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Azure Spring Apps retirement announcement →

  Supports: Description, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

Official Microsoft Learn documentation →