Managing access: Airflow roles

This page covers day-to-day access management for an Airflow instance secured through Microsoft Entra ID: the roles that exist, what each one can do, and how to grant or revoke them for a user. For the one-time setup that gets Entra ID sign-in working in the first place, see Onboarding: Microsoft Entra ID.

Roles

Two Entra ID App Roles are defined on the Airflow Enterprise Application. They map directly to Airflow’s own built-in RBAC roles of the same tier:

Airflow User

Day-to-day operational access for people who build and run pipelines:

  • View, trigger, pause/unpause, and clear runs for DAGs

  • Browse task logs, Grid/Graph view, and XCom values

  • View (but not edit) connections, variables, and pools

Airflow Admin

Everything Airflow User can do, plus platform-administration actions:

  • Create, edit, and delete connections, variables, and pools

  • Manage users, roles, and permissions inside Airflow itself

  • Access the Airflow configuration view and DAG import errors panel

A user can hold both roles at once, though there’s no real need to: Airflow User is a subset of Airflow Admin, so holding Admin already implies User-level access. There is no separate “read-only viewer” role; the narrowest access available is Airflow User.

Granting a role

Do this in the Azure portal, not in Airflow itself. Role membership is synced from Entra ID into Airflow, not the other way around.

  1. Sign in to portal.azure.com with an account that can manage the Airflow Enterprise Application (the Cloud Application Administrator account used during onboarding, or any account your organization has since granted equivalent rights).

  2. Open Microsoft Entra ID → Enterprise Applications, search for airflow, and open the application.

  3. Click Manage → Users and groups.

  4. To grant a new user or group access: click Add user/group, pick the user or group, choose Airflow User or Airflow Admin as the role, then Assign.

    To change an existing assignment: select the checkbox next to the user or group, click Edit assignment, pick the role, then save.

    Tip

    Prefer assigning roles to a group rather than individual users where you can — it’s one place to add or remove people later, instead of editing the Enterprise Application every time someone joins or leaves the team.

  5. Revoking access works the same way: select the user or group and remove the assignment, or delete them from the group the role is assigned to.

Role sync timing

A role change doesn’t apply to an already-open Airflow session immediately. The affected user should log out of Airflow to force re-sync, then wait before logging back in (sync can take up to 15 minutes). Until then they may still see the old permission set, or a 403 Forbidden if this is their first-ever role assignment.