Azure Web and Mobile built-in role
Azure Spring Cloud Config Server Contributor
Reads, writes, and deletes content in the managed Spring Cloud Config Server through DataActions only. It does not manage the Azure Spring Apps resource through the control plane. Azure Spring Apps Basic, Standard, and Enterprise plans retire on March 31, 2028.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: a06f5c24-21a7-4e1a-aa2b-f19eb6684f5b
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (3)
Microsoft.AppPlatform/Spring/configService/readMicrosoft.AppPlatform/Spring/configService/writeMicrosoft.AppPlatform/Spring/configService/delete
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the existing Azure Spring Apps service instance whose managed Config Server the principal must access. A parent-scope assignment is inherited by Config Servers in additional Spring Apps instances, so service-instance scope is the practical boundary for one retiring deployment.
Common use cases (2)
- Let an external application, migration tool, user, service principal, or managed identity read and change managed Config Server content through Microsoft Entra token authentication.
- Update or remove configuration content during a controlled migration from an existing Basic or Standard Azure Spring Apps instance.
Prerequisites (2)
- An existing Basic or Standard Azure Spring Apps instance must expose the managed Config Server endpoint; applications running inside the service normally use platform-managed certificate authentication and do not need this assignment.
- The external principal must be able to obtain a Microsoft Entra access token and the change workflow must be tied to an approved remaining operational or migration need.
Best practices (3)
- Use Config Server Reader when the principal does not need to change or delete configuration content.
- Assign directly on the service instance, protect service-principal credentials, and remove access after the external or migration workflow ends.
- Migrate configuration to Azure Container Apps, AKS, or another supported platform before March 31, 2028.
Security considerations (3)
- The role can alter or delete centralized configuration consumed by distributed applications, which can disrupt workloads or change their runtime behavior.
- Configuration content can contain sensitive operational values, and the role grants both read and mutation authority over that data plane.
- A parent-scope assignment extends Config Server mutation authority to every inherited Azure Spring Apps instance.
Assignment guidance
For an existing external Config Server workflow, assign the Contributor directly on the Azure Spring Apps service instance to the application or migration identity that must change content. Use Reader for inspection-only access, document the migration deadline, and remove the assignment when the dependency is retired.
Related roles (1)
- Azure Spring Cloud Config Server Reader: Provides read access to managed Config Server content without write or delete DataActions.
Common questions
When should I assign the Azure Spring Cloud Config Server Contributor Azure role?
Assign Azure Spring Cloud Config Server Contributor when you need to: Let an external application, migration tool, user, service principal, or managed identity read and change managed Config Server content through Microsoft Entra token authentication.; and Update or remove configuration content during a controlled migration from an existing Basic or Standard Azure Spring Apps instance.. Practical scope: Assign on the existing Azure Spring Apps service instance whose managed Config Server the principal must access. A parent-scope assignment is inherited by Config Servers in additional Spring Apps instances, so service-instance scope is the practical boundary for one retiring deployment.
What permissions does the Azure Spring Cloud Config Server Contributor Azure role grant?
The role definition grants 3 combined control-plane and data-plane actions. Representative operations include: Microsoft.AppPlatform/Spring/configService/read; Microsoft.AppPlatform/Spring/configService/write; and Microsoft.AppPlatform/Spring/configService/delete. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Spring Cloud Config Server Contributor Azure role?
Key considerations when assigning Azure Spring Cloud Config Server Contributor: The role can alter or delete centralized configuration consumed by distributed applications, which can disrupt workloads or change their runtime behavior.; Configuration content can contain sensitive operational values, and the role grants both read and mutation authority over that data plane.; and A parent-scope assignment extends Config Server mutation authority to every inherited Azure Spring Apps instance.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Web and Mobile - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Access Config Server and Service Registry →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Azure Spring Apps retirement announcement →
Supports: Description, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.