Azure Analytics built-in role

Azure Event Hubs Data Owner

Provides complete access to Azure Event Hubs resources. Its Microsoft.EventHub wildcard appears in both control-plane Actions and data-plane DataActions, so the role spans resource administration and event-data operations.

Control-plane actions (1)

• Microsoft.EventHub/*

Data-plane actions (1)

• Microsoft.EventHub/*

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Event Hubs data roles can be assigned at consumer-group, event-hub, namespace, resource-group, or subscription scope. Access at a parent scope is inherited by child Event Hubs resources; Microsoft recommends the narrowest scope that contains the required resources.

Common use cases (2)

• Authorize a trusted Event Hubs administrator or workload that genuinely needs complete control-plane and event-data access within the selected scope.
• Manage Event Hubs resources while also sending and receiving events when those duties cannot be separated between identities.

Prerequisites (2)

• Use a Microsoft Entra user, application service principal, or managed identity that can authenticate and obtain an OAuth 2.0 token for Event Hubs.
• Determine whether complete administration plus event-data access is required before selecting Data Owner instead of a send-only or receive-only role.

Best practices (3)

• Use Azure Event Hubs Data Sender or Azure Event Hubs Data Receiver when the principal needs only one data path.
• Assign at the event hub or namespace instead of resource-group or subscription scope unless every inherited Event Hubs resource requires the same full access.
• Prefer Microsoft Entra authorization and managed identities for Azure-hosted applications instead of shared access keys.

Security considerations (3)

• The role combines full Event Hubs management Actions with full Event Hubs DataActions, making it broader than either Sender or Receiver.
• A resource-group or subscription assignment extends complete Event Hubs access to every inherited Event Hubs resource.
• Azure role assignments can take up to five minutes to propagate, which must be considered when granting or revoking access.

Assignment guidance

Assign Azure Event Hubs Data Owner only to a trusted principal that needs both resource administration and event-data access, preferably on one event hub or namespace. Select Sender or Receiver for one-direction data access and avoid parent scopes that include unrelated Event Hubs resources.

Related roles (2)

• Azure Event Hubs Data Sender: Microsoft documents Data Sender as the narrower built-in role for principals that only send events.
• Azure Event Hubs Data Receiver: Microsoft documents Data Receiver as the narrower built-in role for principals that only receive events.

Editorial sources (6)

• Azure built-in roles for Analytics →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Authorize Azure Event Hubs Access With Microsoft Entra ID →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →