Azure Web and Mobile built-in role
Web PubSub Service Reader
Provides read-only access to Azure Web PubSub data-plane REST APIs. It has no control-plane Actions and cannot perform write operations, generate client tokens through Auth APIs, manage the Web PubSub resource, or create Azure role assignments.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: bfb1c7d2-fb1a-466b-b2ba-aee63b92deaf
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (1)
Microsoft.SignalRService/WebPubSub/*/read
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign directly on the Azure Web PubSub resource monitored by the principal. A parent-scope assignment is inherited by every Web PubSub resource below it and broadens data-plane visibility.
Common use cases (2)
- Run a monitoring tool that calls read-only Azure Web PubSub REST APIs.
- Inspect Web PubSub data-plane state without granting client-token generation or write-capable service operations.
Prerequisites (2)
- An Azure Web PubSub resource and a monitoring application, service principal, or managed identity capable of obtaining a Microsoft Entra token must exist.
- The workflow must use only read-only REST APIs; upstream negotiation or client-event handling requires Service Owner.
Best practices (3)
- Assign to the monitoring identity on the individual Web PubSub resource and use Microsoft Entra authorization instead of access keys.
- Protect monitoring output because read-only service state can still contain operationally sensitive information.
- Elevate to Service Owner only when a reviewed workload needs write or Auth APIs.
Security considerations (3)
- The role exposes Web PubSub data-plane information even though it cannot change service state.
- It does not authorize client-token generation, negotiation, message sends, or other write operations.
- A parent-scope assignment exposes read-only data-plane state from all inherited Web PubSub resources.
Assignment guidance
Assign Web PubSub Service Reader directly on the Web PubSub resource to the monitoring workload identity. Use Service Owner only for upstream or negotiation servers that need write and Auth APIs, and use SignalR/Web PubSub Contributor separately for control-plane administration.
Related roles (2)
- Web PubSub Service Owner: Adds write-capable REST APIs and authentication APIs for client-token generation.
- SignalR/Web PubSub Contributor: Provides control-plane resource management without Web PubSub data-plane access.
Common questions
When should I assign the Web PubSub Service Reader Azure role?
Assign Web PubSub Service Reader when you need to: Run a monitoring tool that calls read-only Azure Web PubSub REST APIs.; and Inspect Web PubSub data-plane state without granting client-token generation or write-capable service operations.. Practical scope: Assign directly on the Azure Web PubSub resource monitored by the principal. A parent-scope assignment is inherited by every Web PubSub resource below it and broadens data-plane visibility.
What permissions does the Web PubSub Service Reader Azure role grant?
The role definition grants 1 combined control-plane and data-plane actions. Representative operations include: Microsoft.SignalRService/WebPubSub/*/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Web PubSub Service Reader Azure role?
Key considerations when assigning Web PubSub Service Reader: The role exposes Web PubSub data-plane information even though it cannot change service state.; It does not authorize client-token generation, negotiation, message sends, or other write operations.; and A parent-scope assignment exposes read-only data-plane state from all inherited Web PubSub resources.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Web and Mobile - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Authorize access to Web PubSub resources using Microsoft Entra ID →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.