Azure Web and Mobile built-in role
Web PubSub Service Owner
Provides full access to Azure Web PubSub data-plane APIs, including read and write REST APIs and authentication APIs used to generate client tokens. It has no control-plane Actions, so it does not create or configure the Web PubSub resource or assign Azure roles.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 12cf5a90-567b-43ae-8102-96cf46c7d9b4
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (1)
Microsoft.SignalRService/WebPubSub/*
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign directly on the Azure Web PubSub resource used by the upstream or negotiation server. A parent-scope assignment is inherited by every Web PubSub resource below it and grants full data-plane access to each inherited instance.
Common use cases (2)
- Run an upstream server that handles negotiation requests and client events for one Azure Web PubSub resource.
- Generate client access tokens and perform write-capable Web PubSub REST operations using Microsoft Entra authorization.
Prerequisites (2)
- An Azure Web PubSub resource and an application, service principal, or managed identity capable of obtaining a Microsoft Entra OAuth 2.0 token must exist.
- The workload must require write-capable REST or Auth APIs; monitoring-only workloads should use Web PubSub Service Reader.
Best practices (3)
- Use Microsoft Entra authorization instead of access keys when possible and assign on the individual Web PubSub resource.
- Reserve Owner for the upstream or negotiation identity that needs Auth and write APIs; use Reader for read-only monitoring.
- Keep control-plane resource management on SignalR/Web PubSub Contributor rather than combining human administration with application data access.
Security considerations (3)
- The role can generate client tokens and exercise every Web PubSub data-plane API, including operations that affect hubs, groups, users, messages, and connections.
- Compromise of the assigned identity can affect all clients and data-plane state on the resource.
- Despite its name, this Owner role cannot manage the Azure resource or create role assignments because it contains DataActions only.
Assignment guidance
Assign Web PubSub Service Owner to the upstream or negotiation application identity directly on one Web PubSub resource. Use Service Reader for monitoring, SignalR/Web PubSub Contributor for control-plane resource management, and a separate access-administration role for Azure RBAC delegation.
Related roles (2)
- Web PubSub Service Reader: Limits Web PubSub data-plane access to read-only REST APIs.
- SignalR/Web PubSub Contributor: Manages the Web PubSub resource through the control plane but grants no data-plane API access.
Common questions
When should I assign the Web PubSub Service Owner Azure role?
Assign Web PubSub Service Owner when you need to: Run an upstream server that handles negotiation requests and client events for one Azure Web PubSub resource.; and Generate client access tokens and perform write-capable Web PubSub REST operations using Microsoft Entra authorization.. Practical scope: Assign directly on the Azure Web PubSub resource used by the upstream or negotiation server. A parent-scope assignment is inherited by every Web PubSub resource below it and grants full data-plane access to each inherited instance.
What permissions does the Web PubSub Service Owner Azure role grant?
The role definition grants 1 combined control-plane and data-plane actions. Representative operations include: Microsoft.SignalRService/WebPubSub/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Web PubSub Service Owner Azure role?
Key considerations when assigning Web PubSub Service Owner: The role can generate client tokens and exercise every Web PubSub data-plane API, including operations that affect hubs, groups, users, messages, and connections.; Compromise of the assigned identity can affect all clients and data-plane state on the resource.; and Despite its name, this Owner role cannot manage the Azure resource or create role assignments because it contains DataActions only.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Web and Mobile - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Authorize access to Web PubSub resources using Microsoft Entra ID →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.