Azure Management and governance built-in role
Template Spec Reader
Reads Azure Resource Manager template specs and their versions. Microsoft documents that read access is sufficient to reference a template spec for deployment, but the principal still needs separate permissions to create the target deployment and every resource in it.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 392ae280-861d-42bd-9ea5-08ee6d83b80e
Control-plane actions (1)
Microsoft.Resources/templateSpecs/*/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Azure RBAC assignments apply at the selected scope and are inherited by child scopes. Keep the assignment at the narrowest resource, resource group, subscription, or management-group boundary that contains the intended resources. Assign on one template spec or the dedicated library resource group. The read assignment controls access to stored template content, not authority at the deployment target scope.
Common use cases (2)
- Allow a deployment pipeline or user to retrieve and deploy an approved template spec.
- Inspect canonical infrastructure templates and versions without changing the shared library.
Prerequisites (2)
- The template spec and required version must exist.
- Grant the deployment identity separate permissions at the resource group, subscription, management group, or tenant target used by the template.
Best practices (2)
- Assign to consumer groups or deployment identities at the template spec or library scope.
- Pin deployments to reviewed versions and keep target deployment rights independent from library read access.
Security considerations (2)
- Template content can reveal infrastructure architecture, parameters, dependencies, and security configuration.
- Reader cannot modify the template spec, and template-spec read access alone cannot deploy target resources.
Assignment guidance
Assign to template consumers at the individual spec or library resource group. Add only the separate target-scope deployment permissions required by the approved template.
Related roles (1)
- Template Spec Contributor: Adds template spec publication, versioning, update, and deletion.
Common questions
When should I assign the Template Spec Reader Azure role?
Assign Template Spec Reader when you need to: Allow a deployment pipeline or user to retrieve and deploy an approved template spec.; and Inspect canonical infrastructure templates and versions without changing the shared library.. Practical scope: Azure RBAC assignments apply at the selected scope and are inherited by child scopes. Keep the assignment at the narrowest resource, resource group, subscription, or management-group boundary that contains the intended resources. Assign on one template spec or the dedicated library resource group. The read assignment controls access to stored template content, not authority at the deployment target scope.
What permissions does the Template Spec Reader Azure role grant?
The role definition grants 1 combined control-plane and data-plane actions. Representative operations include: Microsoft.Resources/templateSpecs/*/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Template Spec Reader Azure role?
Key considerations when assigning Template Spec Reader: Template content can reveal infrastructure architecture, parameters, dependencies, and security configuration.; and Reader cannot modify the template spec, and template-spec read access alone cannot deploy target resources.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for Management and governance →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Azure Resource Manager template specs →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.