Which role in Azure RBAC can view existing Azure resources but cannot modify them?

The Reader role in Azure Role-Based Access Control (RBAC) is specifically designed to grant users the ability to view existing Azure resources without providing any permissions to make changes. This means that users assigned the Reader role can inspect resources, examine configurations, and gather information but are restricted from modifying resource properties or configurations.

This role is particularly useful for audit purposes or when stakeholders need to monitor resources without unintentionally altering any settings that might affect their operation. The other roles fundamentally include permissions that allow for modifications or administrative tasks, making them unsuitable for a user who only needs to observe resources without modifying them.

Therefore, the Reader role is the ideal choice when the requirement is to have view-only access to Azure resources, ensuring that sensitive configurations remain intact and preventing unintentional changes.