Azure Analytics built-in role

Azure Event Hubs Data Receiver

Allows a principal to receive events from Azure Event Hubs. The role uses a control-plane Action to read consumer groups and a data-plane DataAction to receive events; it does not provide the complete access of Data Owner.

Control-plane actions (1)

• Microsoft.EventHub/*/eventhubs/consumergroups/read

Data-plane actions (1)

• Microsoft.EventHub/*/receive/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign at a consumer group when one consuming application needs access to its independent view of the event stream, at an event hub for its consumer groups, or at a namespace for all contained event hubs. Resource-group and subscription assignments are inherited more broadly; the Azure portal does not currently support consumer-group-level role assignment.

Common use cases (2)

• Authorize an application, service principal, managed identity, or user to consume events from an approved event hub.
• Support independent consuming applications that read the same event hub separately by giving each application receive access to its own consumer group.

Prerequisites (2)

• The consumer must authenticate with Microsoft Entra ID and obtain an OAuth 2.0 access token for Event Hubs.
• Select the consumer group, event hub, or namespace that matches the intended receive boundary before creating the role assignment.

Best practices (3)

• Create a separate consumer group for each independent consuming application, and keep receive access at consumer-group scope when namespace-wide access is unnecessary.
• Prefer a managed identity for an Azure-hosted consumer so application credentials do not need to be stored and rotated.
• Use Data Owner only when the same principal also requires complete Event Hubs administration and data access.

Security considerations (3)

• The receive DataAction exposes event contents available at the assigned scope.
• Namespace, resource-group, and subscription assignments can expose events from more event hubs than a consumer-group or event-hub assignment.
• The role does not grant send access or complete Event Hubs management access by itself.

Assignment guidance

Assign Azure Event Hubs Data Receiver to the consuming identity at the narrowest supported consumer-group, event-hub, or namespace scope. Use command-line tooling for consumer-group scope because the Azure portal does not currently support assignments at that level.

Related roles (2)

• Azure Event Hubs Data Owner: Data Owner is the documented complete-access role and is broader than receive-only access.
• Azure Event Hubs Data Sender: Data Sender is the separate built-in role for producer identities that send rather than receive events.

Editorial sources (7)

• Azure built-in roles for Analytics →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Authorize Azure Event Hubs Access With Microsoft Entra ID →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Event Hubs features and terminology →

  Supports: Practical scope, Common use cases, Best practices. Retrieved 2026-07-17.

Official Microsoft Learn documentation →