Microsoft's edit · Azure built-in roles · integration

77 author: rolyon

88 manager: pmwongera

99 ms.author: rolyon

10 −ms.date: 04/09/2026

11 −ms.custom: generated

12 −---

13 −

14 −# Azure built-in roles for Integration

15 −

16 −This article lists the Azure built-in roles in the Integration category.

17 −

18 −

19 −## API Management Developer Portal Content Editor

20 −

21 −Can customize the developer portal, edit its content, and publish it.

22 −

23 −[Learn more](/azure/api-management/api-management-role-based-access-control)

24 −

25 −> [!div class="mx-tableFixed"]

26 −> | Actions | Description |

27 −> | --- | --- |

28 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/portalRevisions/read | Lists a collection of developer portal revision entities. or Gets developer portal revision specified by its identifier. |

29 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/portalRevisions/write | Creates a new developer portal revision. or Updates the description of specified portal revision or makes it current. |

30 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/contentTypes/read | Returns list of content types or Returns content type |

31 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/contentTypes/delete | Removes content type. |

32 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/contentTypes/write | Creates new content type |

33 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/contentTypes/contentItems/read | Returns list of content items or Returns content item details |

34 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/contentTypes/contentItems/write | Creates new content item or Updates specified content item |

35 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/contentTypes/contentItems/delete | Removes specified content item. |

36 −> | **NotActions** | |

37 −> | *none* | |

38 −> | **DataActions** | |

39 −> | *none* | |

40 −> | **NotDataActions** | |

41 −> | *none* | |

42 −

43 −```json

44 −{

45 − "assignableScopes": [

46 − "/"

47 − ],

48 − "description": "Can customize the developer portal, edit its content, and publish it.",

49 − "id": "/providers/Microsoft.Authorization/roleDefinitions/c031e6a8-4391-4de0-8d69-4706a7ed3729",

50 − "name": "c031e6a8-4391-4de0-8d69-4706a7ed3729",

51 − "permissions": [

52 − {

53 − "actions": [

54 − "Microsoft.ApiManagement/service/portalRevisions/read",

55 − "Microsoft.ApiManagement/service/portalRevisions/write",

56 − "Microsoft.ApiManagement/service/contentTypes/read",

57 − "Microsoft.ApiManagement/service/contentTypes/delete",

58 − "Microsoft.ApiManagement/service/contentTypes/write",

59 − "Microsoft.ApiManagement/service/contentTypes/contentItems/read",

60 − "Microsoft.ApiManagement/service/contentTypes/contentItems/write",

61 − "Microsoft.ApiManagement/service/contentTypes/contentItems/delete"

62 − ],

63 − "notActions": [],

64 − "dataActions": [],

65 − "notDataActions": []

66 − }

67 − ],

68 − "roleName": "API Management Developer Portal Content Editor",

69 − "roleType": "BuiltInRole",

70 − "type": "Microsoft.Authorization/roleDefinitions"

71 −}

72 −```

73 −

74 −## API Management Service Contributor

75 −

76 −Can manage service and the APIs

77 −

78 −[Learn more](/azure/api-management/api-management-role-based-access-control)

79 −

80 −> [!div class="mx-tableFixed"]

81 −> | Actions | Description |

82 −> | --- | --- |

83 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/* | Create and manage API Management service |

84 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

85 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

86 −> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |

87 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

88 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

89 −> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |

90 −> | **NotActions** | |

91 −> | *none* | |

92 −> | **DataActions** | |

93 −> | *none* | |

94 −> | **NotDataActions** | |

95 −> | *none* | |

96 −

97 −```json

98 −{

99 − "assignableScopes": [

100 − "/"

101 − ],

102 − "description": "Can manage service and the APIs",

103 − "id": "/providers/Microsoft.Authorization/roleDefinitions/312a565d-c81f-4fd8-895a-4e21e48d571c",

104 − "name": "312a565d-c81f-4fd8-895a-4e21e48d571c",

105 − "permissions": [

106 − {

107 − "actions": [

108 − "Microsoft.ApiManagement/service/*",

109 − "Microsoft.Authorization/*/read",

110 − "Microsoft.Insights/alertRules/*",

111 − "Microsoft.ResourceHealth/availabilityStatuses/read",

112 − "Microsoft.Resources/deployments/*",

113 − "Microsoft.Resources/subscriptions/resourceGroups/read",

114 − "Microsoft.Support/*"

115 − ],

116 − "notActions": [],

117 − "dataActions": [],

118 − "notDataActions": []

119 − }

120 − ],

121 − "roleName": "API Management Service Contributor",

122 − "roleType": "BuiltInRole",

123 − "type": "Microsoft.Authorization/roleDefinitions"

124 −}

125 −```

126 −

127 −## API Management Service Operator Role

128 −

129 −Can manage service but not the APIs

130 −

131 −[Learn more](/azure/api-management/api-management-role-based-access-control)

132 −

133 −> [!div class="mx-tableFixed"]

134 −> | Actions | Description |

135 −> | --- | --- |

136 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/*/read | Read API Management Service instances |

137 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/backup/action | Backup API Management Service to the specified container in a user provided storage account |

138 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/delete | Delete API Management Service instance |

139 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/managedeployments/action | Change SKU/units, add/remove regional deployments of API Management Service |

140 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/read | Read metadata for an API Management Service instance |

141 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/restore/action | Restore API Management Service from the specified container in a user provided storage account |

142 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/updatecertificate/action | Upload TLS/SSL certificate for an API Management Service |

143 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/updatehostname/action | Setup, update or remove custom domain names for an API Management Service |

144 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/write | Create or Update API Management Service instance |

145 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

146 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

147 −> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |

148 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

149 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

150 −> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |

151 −> | **NotActions** | |

152 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/users/keys/read | Get keys associated with user |

153 −> | **DataActions** | |

154 −> | *none* | |

155 −> | **NotDataActions** | |

156 −> | *none* | |

157 −

158 −```json

159 −{

160 − "assignableScopes": [

161 − "/"

162 − ],

163 − "description": "Can manage service but not the APIs",

164 − "id": "/providers/Microsoft.Authorization/roleDefinitions/e022efe7-f5ba-4159-bbe4-b44f577e9b61",

165 − "name": "e022efe7-f5ba-4159-bbe4-b44f577e9b61",

166 − "permissions": [

167 − {

168 − "actions": [

169 − "Microsoft.ApiManagement/service/*/read",

170 − "Microsoft.ApiManagement/service/backup/action",

171 − "Microsoft.ApiManagement/service/delete",

172 − "Microsoft.ApiManagement/service/managedeployments/action",

173 − "Microsoft.ApiManagement/service/read",

174 − "Microsoft.ApiManagement/service/restore/action",

175 − "Microsoft.ApiManagement/service/updatecertificate/action",

176 − "Microsoft.ApiManagement/service/updatehostname/action",

177 − "Microsoft.ApiManagement/service/write",

178 − "Microsoft.Authorization/*/read",

179 − "Microsoft.Insights/alertRules/*",

180 − "Microsoft.ResourceHealth/availabilityStatuses/read",

181 − "Microsoft.Resources/deployments/*",

182 − "Microsoft.Resources/subscriptions/resourceGroups/read",

183 − "Microsoft.Support/*"

184 − ],

185 − "notActions": [

186 − "Microsoft.ApiManagement/service/users/keys/read"

187 − ],

188 − "dataActions": [],

189 − "notDataActions": []

190 − }

191 − ],

192 − "roleName": "API Management Service Operator Role",

193 − "roleType": "BuiltInRole",

194 − "type": "Microsoft.Authorization/roleDefinitions"

195 −}

196 −```

197 −

198 −## API Management Service Reader Role

199 −

200 −Read-only access to service and APIs

201 −

202 −[Learn more](/azure/api-management/api-management-role-based-access-control)

203 −

204 −> [!div class="mx-tableFixed"]

205 −> | Actions | Description |

206 −> | --- | --- |

207 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/*/read | Read API Management Service instances |

208 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/read | Read metadata for an API Management Service instance |

209 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

210 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

211 −> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |

212 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

213 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

214 −> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |

215 −> | **NotActions** | |

216 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/users/keys/read | Get keys associated with user |

217 −> | **DataActions** | |

218 −> | *none* | |

219 −> | **NotDataActions** | |

220 −> | *none* | |

221 −

222 −```json

223 −{

224 − "assignableScopes": [

225 − "/"

226 − ],

227 − "description": "Read-only access to service and APIs",

228 − "id": "/providers/Microsoft.Authorization/roleDefinitions/71522526-b88f-4d52-b57f-d31fc3546d0d",

229 − "name": "71522526-b88f-4d52-b57f-d31fc3546d0d",

230 − "permissions": [

231 − {

232 − "actions": [

233 − "Microsoft.ApiManagement/service/*/read",

234 − "Microsoft.ApiManagement/service/read",

235 − "Microsoft.Authorization/*/read",

236 − "Microsoft.Insights/alertRules/*",

237 − "Microsoft.ResourceHealth/availabilityStatuses/read",

238 − "Microsoft.Resources/deployments/*",

239 − "Microsoft.Resources/subscriptions/resourceGroups/read",

240 − "Microsoft.Support/*"

241 − ],

242 − "notActions": [

243 − "Microsoft.ApiManagement/service/users/keys/read"

244 − ],

245 − "dataActions": [],

246 − "notDataActions": []

247 − }

248 − ],

249 − "roleName": "API Management Service Reader Role",

250 − "roleType": "BuiltInRole",

251 − "type": "Microsoft.Authorization/roleDefinitions"

252 −}

253 −```

254 −

255 −## API Management Service Workspace API Developer

256 −

257 −Has read access to tags and products and write access to allow: assigning APIs to products, assigning tags to products and APIs. This role should be assigned on the service scope.

258 −

259 −[Learn more](/azure/api-management/api-management-role-based-access-control)

260 −

261 −> [!div class="mx-tableFixed"]

262 −> | Actions | Description |

263 −> | --- | --- |

264 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/tags/read | Lists a collection of tags defined within a service instance. or Gets the details of the tag specified by its identifier. |

265 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/tags/apiLinks/* | |

266 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/tags/operationLinks/* | |

267 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/tags/productLinks/* | |

268 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/products/read | Lists a collection of products in the specified service instance. or Gets the details of the product specified by its identifier. |

269 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/products/apiLinks/* | |

270 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/read | Read metadata for an API Management Service instance |

271 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/authorizationServers/read | Lists a collection of authorization servers defined within a service instance. or Gets the details of the authorization server without secrets. |

272 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

273 −> | **NotActions** | |

274 −> | *none* | |

275 −> | **DataActions** | |

276 −> | *none* | |

277 −> | **NotDataActions** | |

278 −> | *none* | |

279 −

280 −```json

281 −{

282 − "assignableScopes": [

283 − "/"

284 − ],

285 − "description": "Has read access to tags and products and write access to allow: assigning APIs to products, assigning tags to products and APIs. This role should be assigned on the service scope.",

286 − "id": "/providers/Microsoft.Authorization/roleDefinitions/9565a273-41b9-4368-97d2-aeb0c976a9b3",

287 − "name": "9565a273-41b9-4368-97d2-aeb0c976a9b3",

288 − "permissions": [

289 − {

290 − "actions": [

291 − "Microsoft.ApiManagement/service/tags/read",

292 − "Microsoft.ApiManagement/service/tags/apiLinks/*",

293 − "Microsoft.ApiManagement/service/tags/operationLinks/*",

294 − "Microsoft.ApiManagement/service/tags/productLinks/*",

295 − "Microsoft.ApiManagement/service/products/read",

296 − "Microsoft.ApiManagement/service/products/apiLinks/*",

297 − "Microsoft.ApiManagement/service/read",

298 − "Microsoft.ApiManagement/service/authorizationServers/read",

299 − "Microsoft.Authorization/*/read"

300 − ],

301 − "notActions": [],

302 − "dataActions": [],

303 − "notDataActions": []

304 − }

305 − ],

306 − "roleName": "API Management Service Workspace API Developer",

307 − "roleType": "BuiltInRole",

308 − "type": "Microsoft.Authorization/roleDefinitions"

309 −}

310 −```

311 −

312 −## API Management Service Workspace API Product Manager

313 −

314 −Has the same access as API Management Service Workspace API Developer as well as read access to users and write access to allow assigning users to groups. This role should be assigned on the service scope.

315 −

316 −[Learn more](/azure/api-management/api-management-role-based-access-control)

317 −

318 −> [!div class="mx-tableFixed"]

319 −> | Actions | Description |

320 −> | --- | --- |

321 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/users/read | Lists a collection of registered users in the specified service instance. or Gets the details of the user specified by its identifier. |

322 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/tags/read | Lists a collection of tags defined within a service instance. or Gets the details of the tag specified by its identifier. |

323 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/tags/apiLinks/* | |

324 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/tags/operationLinks/* | |

325 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/tags/productLinks/* | |

326 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/products/read | Lists a collection of products in the specified service instance. or Gets the details of the product specified by its identifier. |

327 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/products/apiLinks/* | |

328 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/groups/read | Lists a collection of groups defined within a service instance. or Gets the details of the group specified by its identifier. |

329 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/groups/users/* | |

330 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/read | Read metadata for an API Management Service instance |

331 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/authorizationServers/read | Lists a collection of authorization servers defined within a service instance. or Gets the details of the authorization server without secrets. |

332 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

333 −> | **NotActions** | |

334 −> | *none* | |

335 −> | **DataActions** | |

336 −> | *none* | |

337 −> | **NotDataActions** | |

338 −> | *none* | |

339 −

340 −```json

341 −{

342 − "assignableScopes": [

343 − "/"

344 − ],

345 − "description": "Has the same access as API Management Service Workspace API Developer as well as read access to users and write access to allow assigning users to groups. This role should be assigned on the service scope.",

346 − "id": "/providers/Microsoft.Authorization/roleDefinitions/d59a3e9c-6d52-4a5a-aeed-6bf3cf0e31da",

347 − "name": "d59a3e9c-6d52-4a5a-aeed-6bf3cf0e31da",

348 − "permissions": [

349 − {

350 − "actions": [

351 − "Microsoft.ApiManagement/service/users/read",

352 − "Microsoft.ApiManagement/service/tags/read",

353 − "Microsoft.ApiManagement/service/tags/apiLinks/*",

354 − "Microsoft.ApiManagement/service/tags/operationLinks/*",

355 − "Microsoft.ApiManagement/service/tags/productLinks/*",

356 − "Microsoft.ApiManagement/service/products/read",

357 − "Microsoft.ApiManagement/service/products/apiLinks/*",

358 − "Microsoft.ApiManagement/service/groups/read",

359 − "Microsoft.ApiManagement/service/groups/users/*",

360 − "Microsoft.ApiManagement/service/read",

361 − "Microsoft.ApiManagement/service/authorizationServers/read",

362 − "Microsoft.Authorization/*/read"

363 − ],

364 − "notActions": [],

365 − "dataActions": [],

366 − "notDataActions": []

367 − }

368 − ],

369 − "roleName": "API Management Service Workspace API Product Manager",

370 − "roleType": "BuiltInRole",

371 − "type": "Microsoft.Authorization/roleDefinitions"

372 −}

373 −```

374 −

375 −## API Management Workspace API Developer

376 −

377 −Has read access to entities in the workspace and read and write access to entities for editing APIs. This role should be assigned on the workspace scope.

378 −

379 −[Learn more](/azure/api-management/api-management-role-based-access-control)

380 −

381 −> [!div class="mx-tableFixed"]

382 −> | Actions | Description |

383 −> | --- | --- |

384 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/workspaces/*/read | |

385 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/workspaces/apis/* | |

386 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/workspaces/apiVersionSets/* | |

387 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/workspaces/policies/* | |

388 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/workspaces/schemas/* | |

389 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/workspaces/products/* | |

390 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/workspaces/policyFragments/* | |

391 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/workspaces/namedValues/* | |

392 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/workspaces/tags/* | |

393 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/workspaces/backends/* | |

394 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/workspaces/certificates/* | |

395 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/workspaces/diagnostics/* | |

396 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/workspaces/loggers/* | |

397 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

398 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/diagnosticSettings/*/read | |

399 −> | [Microsoft.insights](../permissions/monitor.md#microsoftinsights)/logs/read | Reading data from all your logs |

400 −> | [Microsoft.insights](../permissions/monitor.md#microsoftinsights)/logs/ApiManagementGatewayLogs/read | Read data from the ApiManagementGatewayLogs table |

401 −> | **NotActions** | |

402 −> | *none* | |

403 −> | **DataActions** | |

404 −> | *none* | |

405 −> | **NotDataActions** | |

406 −> | *none* | |

407 −

408 −```json

409 −{

410 − "assignableScopes": [

411 − "/"

412 − ],

413 − "description": "Has read access to entities in the workspace and read and write access to entities for editing APIs. This role should be assigned on the workspace scope.",

414 − "id": "/providers/Microsoft.Authorization/roleDefinitions/56328988-075d-4c6a-8766-d93edd6725b6",

415 − "name": "56328988-075d-4c6a-8766-d93edd6725b6",

416 − "permissions": [

417 − {

418 − "actions": [

419 − "Microsoft.ApiManagement/service/workspaces/*/read",

420 − "Microsoft.ApiManagement/service/workspaces/apis/*",

421 − "Microsoft.ApiManagement/service/workspaces/apiVersionSets/*",

422 − "Microsoft.ApiManagement/service/workspaces/policies/*",

423 − "Microsoft.ApiManagement/service/workspaces/schemas/*",

424 − "Microsoft.ApiManagement/service/workspaces/products/*",

425 − "Microsoft.ApiManagement/service/workspaces/policyFragments/*",

426 − "Microsoft.ApiManagement/service/workspaces/namedValues/*",

427 − "Microsoft.ApiManagement/service/workspaces/tags/*",

428 − "Microsoft.ApiManagement/service/workspaces/backends/*",

429 − "Microsoft.ApiManagement/service/workspaces/certificates/*",

430 − "Microsoft.ApiManagement/service/workspaces/diagnostics/*",

431 − "Microsoft.ApiManagement/service/workspaces/loggers/*",

432 − "Microsoft.Authorization/*/read",

433 − "Microsoft.Insights/diagnosticSettings/*/read",

434 − "Microsoft.insights/logs/read",

435 − "Microsoft.insights/logs/ApiManagementGatewayLogs/read"

436 − ],

437 − "notActions": [],

438 − "dataActions": [],

439 − "notDataActions": []

440 − }

441 − ],

442 − "roleName": "API Management Workspace API Developer",

443 − "roleType": "BuiltInRole",

444 − "type": "Microsoft.Authorization/roleDefinitions"

445 −}

446 −```

447 −

448 −## API Management Workspace API Product Manager

449 −

450 −Has read access to entities in the workspace and read and write access to entities for publishing APIs. This role should be assigned on the workspace scope.

451 −

452 −[Learn more](/azure/api-management/api-management-role-based-access-control)

453 −

454 −> [!div class="mx-tableFixed"]

455 −> | Actions | Description |

456 −> | --- | --- |

457 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/workspaces/*/read | |

458 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/workspaces/products/* | |

459 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/workspaces/subscriptions/* | |

460 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/workspaces/groups/* | |

461 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/workspaces/tags/* | |

462 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/workspaces/notifications/* | |

463 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

464 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/diagnosticSettings/*/read | |

465 −> | [Microsoft.insights](../permissions/monitor.md#microsoftinsights)/logs/read | Reading data from all your logs |

466 −> | [Microsoft.insights](../permissions/monitor.md#microsoftinsights)/logs/ApiManagementGatewayLogs/read | Read data from the ApiManagementGatewayLogs table |

467 −> | **NotActions** | |

468 −> | *none* | |

469 −> | **DataActions** | |

470 −> | *none* | |

471 −> | **NotDataActions** | |

472 −> | *none* | |

473 −

474 −```json

475 −{

476 − "assignableScopes": [

477 − "/"

478 − ],

479 − "description": "Has read access to entities in the workspace and read and write access to entities for publishing APIs. This role should be assigned on the workspace scope.",

480 − "id": "/providers/Microsoft.Authorization/roleDefinitions/73c2c328-d004-4c5e-938c-35c6f5679a1f",

481 − "name": "73c2c328-d004-4c5e-938c-35c6f5679a1f",

482 − "permissions": [

483 − {

484 − "actions": [

485 − "Microsoft.ApiManagement/service/workspaces/*/read",

486 − "Microsoft.ApiManagement/service/workspaces/products/*",

487 − "Microsoft.ApiManagement/service/workspaces/subscriptions/*",

488 − "Microsoft.ApiManagement/service/workspaces/groups/*",

489 − "Microsoft.ApiManagement/service/workspaces/tags/*",

490 − "Microsoft.ApiManagement/service/workspaces/notifications/*",

491 − "Microsoft.Authorization/*/read",

492 − "Microsoft.Insights/diagnosticSettings/*/read",

493 − "Microsoft.insights/logs/read",

494 − "Microsoft.insights/logs/ApiManagementGatewayLogs/read"

495 − ],

496 − "notActions": [],

497 − "dataActions": [],

498 − "notDataActions": []

499 − }

500 − ],

501 − "roleName": "API Management Workspace API Product Manager",

502 − "roleType": "BuiltInRole",

503 − "type": "Microsoft.Authorization/roleDefinitions"

504 −}

505 −```

506 −

507 −## API Management Workspace Contributor

508 −

509 −Can manage the workspace and view, but not modify its members. This role should be assigned on the workspace scope.

510 −

511 −[Learn more](/azure/api-management/api-management-role-based-access-control)

512 −

513 −> [!div class="mx-tableFixed"]

514 −> | Actions | Description |

515 −> | --- | --- |

516 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/workspaces/* | |

517 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

518 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/diagnosticSettings/*/read | |

519 −> | [Microsoft.insights](../permissions/monitor.md#microsoftinsights)/logs/read | Reading data from all your logs |

520 −> | [Microsoft.insights](../permissions/monitor.md#microsoftinsights)/logs/ApiManagementGatewayLogs/read | Read data from the ApiManagementGatewayLogs table |

521 −> | **NotActions** | |

522 −> | *none* | |

523 −> | **DataActions** | |

524 −> | *none* | |

525 −> | **NotDataActions** | |

526 −> | *none* | |

527 −

528 −```json

529 −{

530 − "assignableScopes": [

531 − "/"

532 − ],

533 − "description": "Can manage the workspace and view, but not modify its members. This role should be assigned on the workspace scope.",

534 − "id": "/providers/Microsoft.Authorization/roleDefinitions/0c34c906-8d99-4cb7-8bb7-33f5b0a1a799",

535 − "name": "0c34c906-8d99-4cb7-8bb7-33f5b0a1a799",

536 − "permissions": [

537 − {

538 − "actions": [

539 − "Microsoft.ApiManagement/service/workspaces/*",

540 − "Microsoft.Authorization/*/read",

541 − "Microsoft.Insights/diagnosticSettings/*/read",

542 − "Microsoft.insights/logs/read",

543 − "Microsoft.insights/logs/ApiManagementGatewayLogs/read"

544 − ],

545 − "notActions": [],

546 − "dataActions": [],

547 − "notDataActions": []

548 − }

549 − ],

550 − "roleName": "API Management Workspace Contributor",

551 − "roleType": "BuiltInRole",

552 − "type": "Microsoft.Authorization/roleDefinitions"

553 −}

554 −```

555 −

556 −## API Management Workspace Reader

557 −

558 −Has read-only access to entities in the workspace. This role should be assigned on the workspace scope.

559 −

560 −[Learn more](/azure/api-management/api-management-role-based-access-control)

561 −

562 −> [!div class="mx-tableFixed"]

563 −> | Actions | Description |

564 −> | --- | --- |

565 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/workspaces/*/read | |

566 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

567 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/diagnosticSettings/*/read | |

568 −> | [Microsoft.insights](../permissions/monitor.md#microsoftinsights)/logs/read | Reading data from all your logs |

569 −> | [Microsoft.insights](../permissions/monitor.md#microsoftinsights)/logs/ApiManagementGatewayLogs/read | Read data from the ApiManagementGatewayLogs table |

570 −> | **NotActions** | |

571 −> | *none* | |

572 −> | **DataActions** | |

573 −> | *none* | |

574 −> | **NotDataActions** | |

575 −> | *none* | |

576 −

577 −```json

578 −{

579 − "assignableScopes": [

580 − "/"

581 − ],

582 − "description": "Has read-only access to entities in the workspace. This role should be assigned on the workspace scope.",

583 − "id": "/providers/Microsoft.Authorization/roleDefinitions/ef1c2c96-4a77-49e8-b9a4-6179fe1d2fd2",

584 − "name": "ef1c2c96-4a77-49e8-b9a4-6179fe1d2fd2",

585 − "permissions": [

586 − {

587 − "actions": [

588 − "Microsoft.ApiManagement/service/workspaces/*/read",

589 − "Microsoft.Authorization/*/read",

590 − "Microsoft.Insights/diagnosticSettings/*/read",

591 − "Microsoft.insights/logs/read",

592 − "Microsoft.insights/logs/ApiManagementGatewayLogs/read"

593 − ],

594 − "notActions": [],

595 − "dataActions": [],

596 − "notDataActions": []

597 − }

598 − ],

599 − "roleName": "API Management Workspace Reader",

600 − "roleType": "BuiltInRole",

601 − "type": "Microsoft.Authorization/roleDefinitions"

602 −}

603 −```

604 −

605 −## App Configuration Contributor

606 −

607 −Grants permission for all management operations, except purge, for App Configuration resources. This role does not grant access to data plane resources such as key-values, snapshots, and feature flags.

608 −

609 −> [!div class="mx-tableFixed"]

610 −> | Actions | Description |

611 −> | --- | --- |

612 −> | [Microsoft.AppConfiguration](../permissions/integration.md#microsoftappconfiguration)/* | |

613 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

614 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

615 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

616 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

617 −> | **NotActions** | |

618 −> | [Microsoft.AppConfiguration](../permissions/integration.md#microsoftappconfiguration)/locations/deletedConfigurationStores/purge/action | Purge the specified deleted configuration store. |

619 −> | **DataActions** | |

620 −> | *none* | |

621 −> | **NotDataActions** | |

622 −> | *none* | |

623 −

624 −```json

625 −{

626 − "assignableScopes": [

627 − "/"

628 − ],

629 − "description": "Grants permission for all management operations, except purge, for App Configuration resources. This role does not grant access to data plane resources such as key-values, snapshots, and feature flags.",

630 − "id": "/providers/Microsoft.Authorization/roleDefinitions/fe86443c-f201-4fc4-9d2a-ac61149fbda0",

631 − "name": "fe86443c-f201-4fc4-9d2a-ac61149fbda0",

632 − "permissions": [

633 − {

634 − "actions": [

635 − "Microsoft.AppConfiguration/*",

636 − "Microsoft.Authorization/*/read",

637 − "Microsoft.Insights/alertRules/*",

638 − "Microsoft.Resources/deployments/*",

639 − "Microsoft.Resources/subscriptions/resourceGroups/read"

640 − ],

641 − "notActions": [

642 − "Microsoft.AppConfiguration/locations/deletedConfigurationStores/purge/action"

643 − ],

644 − "dataActions": [],

645 − "notDataActions": []

646 − }

647 − ],

648 − "roleName": "App Configuration Contributor",

649 − "roleType": "BuiltInRole",

650 − "type": "Microsoft.Authorization/roleDefinitions"

651 −}

652 −```

653 −

654 −## App Configuration Data Owner

655 −

656 −Allows full access to App Configuration data.

657 −

658 −[Learn more](/azure/azure-app-configuration/concept-enable-rbac)

659 −

660 −> [!div class="mx-tableFixed"]

661 −> | Actions | Description |

662 −> | --- | --- |

663 −> | *none* | |

664 −> | **NotActions** | |

665 −> | *none* | |

666 −> | **DataActions** | |

667 −> | [Microsoft.AppConfiguration](../permissions/integration.md#microsoftappconfiguration)/configurationStores/*/read | |

668 −> | [Microsoft.AppConfiguration](../permissions/integration.md#microsoftappconfiguration)/configurationStores/*/write | |

669 −> | [Microsoft.AppConfiguration](../permissions/integration.md#microsoftappconfiguration)/configurationStores/*/delete | |

670 −> | [Microsoft.AppConfiguration](../permissions/integration.md#microsoftappconfiguration)/configurationStores/*/action | |

671 −> | **NotDataActions** | |

672 −> | [Microsoft.AppConfiguration](../permissions/integration.md#microsoftappconfiguration)/configurationStores/useSasAuth/action | |

673 −

674 −```json

675 −{

676 − "assignableScopes": [

677 − "/"

678 − ],

679 − "description": "Allows full access to App Configuration data.",

680 − "id": "/providers/Microsoft.Authorization/roleDefinitions/5ae67dd6-50cb-40e7-96ff-dc2bfa4b606b",

681 − "name": "5ae67dd6-50cb-40e7-96ff-dc2bfa4b606b",

682 − "permissions": [

683 − {

684 − "actions": [],

685 − "notActions": [],

686 − "dataActions": [

687 − "Microsoft.AppConfiguration/configurationStores/*/read",

688 − "Microsoft.AppConfiguration/configurationStores/*/write",

689 − "Microsoft.AppConfiguration/configurationStores/*/delete",

690 − "Microsoft.AppConfiguration/configurationStores/*/action"

691 − ],

692 − "notDataActions": [

693 − "Microsoft.AppConfiguration/configurationStores/useSasAuth/action"

694 − ]

695 − }

696 − ],

697 − "roleName": "App Configuration Data Owner",

698 − "roleType": "BuiltInRole",

699 − "type": "Microsoft.Authorization/roleDefinitions"

700 −}

701 −```

702 −

703 −## App Configuration Data Reader

704 −

705 −Allows read access to App Configuration data.

706 −

707 −[Learn more](/azure/azure-app-configuration/concept-enable-rbac)

708 −

709 −> [!div class="mx-tableFixed"]

710 −> | Actions | Description |

711 −> | --- | --- |

712 −> | *none* | |

713 −> | **NotActions** | |

714 −> | *none* | |

715 −> | **DataActions** | |

716 −> | [Microsoft.AppConfiguration](../permissions/integration.md#microsoftappconfiguration)/configurationStores/*/read | |

717 −> | **NotDataActions** | |

718 −> | *none* | |

719 −

720 −```json

721 −{

722 − "assignableScopes": [

723 − "/"

724 − ],

725 − "description": "Allows read access to App Configuration data.",

726 − "id": "/providers/Microsoft.Authorization/roleDefinitions/516239f1-63e1-4d78-a4de-a74fb236a071",

727 − "name": "516239f1-63e1-4d78-a4de-a74fb236a071",

728 − "permissions": [

729 − {

730 − "actions": [],

731 − "notActions": [],

732 − "dataActions": [

733 − "Microsoft.AppConfiguration/configurationStores/*/read"

734 − ],

735 − "notDataActions": []

736 − }

737 − ],

738 − "roleName": "App Configuration Data Reader",

739 − "roleType": "BuiltInRole",

740 − "type": "Microsoft.Authorization/roleDefinitions"

741 −}

742 −```

743 −

744 −## App Configuration Reader

745 −

746 −Grants permission for read operations for App Configuration resources. This role does not grant access to data plane resources such as key-values, snapshots, and feature flags.

747 −

748 −> [!div class="mx-tableFixed"]

749 −> | Actions | Description |

750 −> | --- | --- |

751 −> | [Microsoft.AppConfiguration](../permissions/integration.md#microsoftappconfiguration)/*/read | |

752 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

753 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/read | Read a classic metric alert |

754 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/read | Gets or lists deployments. |

755 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

756 −> | **NotActions** | |

757 −> | *none* | |

758 −> | **DataActions** | |

759 −> | *none* | |

760 −> | **NotDataActions** | |

761 −> | *none* | |

762 −

763 −```json

764 −{

765 − "assignableScopes": [

766 − "/"

767 − ],

768 − "description": "Grants permission for read operations for App Configuration resources. This role does not grant access to data plane resources such as key-values, snapshots, and feature flags.",

769 − "id": "/providers/Microsoft.Authorization/roleDefinitions/175b81b9-6e0d-490a-85e4-0d422273c10c",

770 − "name": "175b81b9-6e0d-490a-85e4-0d422273c10c",

771 − "permissions": [

772 − {

773 − "actions": [

774 − "Microsoft.AppConfiguration/*/read",

775 − "Microsoft.Authorization/*/read",

776 − "Microsoft.Insights/alertRules/read",

777 − "Microsoft.Resources/deployments/read",

778 − "Microsoft.Resources/subscriptions/resourceGroups/read"

779 − ],

780 − "notActions": [],

781 − "dataActions": [],

782 − "notDataActions": []

783 − }

784 − ],

785 − "roleName": "App Configuration Reader",

786 − "roleType": "BuiltInRole",

787 − "type": "Microsoft.Authorization/roleDefinitions"

788 −}

789 −```

790 −

791 −## Azure API Center Compliance Manager

792 −

793 −Grants reader access to AI projects, reader access to AI accounts, and data actions for an AI project. Applies for new Foundry resources.

794 −

795 −[Learn more](/azure/api-center/enable-api-analysis-linting)

796 −

797 −> [!div class="mx-tableFixed"]

798 −> | Actions | Description |

799 −> | --- | --- |

800 −> | [Microsoft.ApiCenter](../permissions/integration.md#microsoftapicenter)/services/*/read | |

801 −> | [Microsoft.ApiCenter](../permissions/integration.md#microsoftapicenter)/services/workspaces/apis/versions/definitions/updateAnalysisState/action | Updates analysis results for specified API definition. |

802 −> | [Microsoft.ApiCenter](../permissions/integration.md#microsoftapicenter)/services/workspaces/apis/versions/definitions/exportSpecification/action | Exports API definition file. |

803 −> | **NotActions** | |

804 −> | *none* | |

805 −> | **DataActions** | |

Azure built-in roles · integration

Microsoft's edit · 25 May 20:49 UTC