Azure Analytics built-in role
Azure Event Hubs Data Receiver
Allows a principal to receive events from Azure Event Hubs. The role uses a control-plane Action to read consumer groups and a data-plane DataAction to receive events; it does not provide the complete access of Data Owner.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: a638d3c7-ab3a-418d-83e6-5f17a39d4fde
Control-plane actions (1)
Microsoft.EventHub/*/eventhubs/consumergroups/read
Data-plane actions (1)
Microsoft.EventHub/*/receive/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign at a consumer group when one consuming application needs access to its independent view of the event stream, at an event hub for its consumer groups, or at a namespace for all contained event hubs. Resource-group and subscription assignments are inherited more broadly; the Azure portal does not currently support consumer-group-level role assignment.
Common use cases (2)
- Authorize an application, service principal, managed identity, or user to consume events from an approved event hub.
- Support independent consuming applications that read the same event hub separately by giving each application receive access to its own consumer group.
Prerequisites (2)
- The consumer must authenticate with Microsoft Entra ID and obtain an OAuth 2.0 access token for Event Hubs.
- Select the consumer group, event hub, or namespace that matches the intended receive boundary before creating the role assignment.
Best practices (3)
- Create a separate consumer group for each independent consuming application, and keep receive access at consumer-group scope when namespace-wide access is unnecessary.
- Prefer a managed identity for an Azure-hosted consumer so application credentials do not need to be stored and rotated.
- Use Data Owner only when the same principal also requires complete Event Hubs administration and data access.
Security considerations (3)
- The receive DataAction exposes event contents available at the assigned scope.
- Namespace, resource-group, and subscription assignments can expose events from more event hubs than a consumer-group or event-hub assignment.
- The role does not grant send access or complete Event Hubs management access by itself.
Assignment guidance
Assign Azure Event Hubs Data Receiver to the consuming identity at the narrowest supported consumer-group, event-hub, or namespace scope. Use command-line tooling for consumer-group scope because the Azure portal does not currently support assignments at that level.
Related roles (2)
- Azure Event Hubs Data Owner: Data Owner is the documented complete-access role and is broader than receive-only access.
- Azure Event Hubs Data Sender: Data Sender is the separate built-in role for producer identities that send rather than receive events.
Common questions
When should I assign the Azure Event Hubs Data Receiver Azure role?
Assign Azure Event Hubs Data Receiver when you need to: Authorize an application, service principal, managed identity, or user to consume events from an approved event hub.; and Support independent consuming applications that read the same event hub separately by giving each application receive access to its own consumer group.. Practical scope: Assign at a consumer group when one consuming application needs access to its independent view of the event stream, at an event hub for its consumer groups, or at a namespace for all contained event hubs. Resource-group and subscription assignments are inherited more broadly; the Azure portal does not currently support consumer-group-level role assignment.
What permissions does the Azure Event Hubs Data Receiver Azure role grant?
The role definition grants 2 combined control-plane and data-plane actions. Representative operations include: Microsoft.EventHub/*/eventhubs/consumergroups/read; and Microsoft.EventHub/*/receive/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Event Hubs Data Receiver Azure role?
Key considerations when assigning Azure Event Hubs Data Receiver: The receive DataAction exposes event contents available at the assigned scope.; Namespace, resource-group, and subscription assignments can expose events from more event hubs than a consumer-group or event-hub assignment.; and The role does not grant send access or complete Event Hubs management access by itself.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Analytics →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Authorize Azure Event Hubs Access With Microsoft Entra ID →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Event Hubs features and terminology →
Supports: Practical scope, Common use cases, Best practices. Retrieved 2026-07-17.