Azure Analytics built-in role
Azure Event Hubs Data Sender
Allows a principal to send events to Azure Event Hubs. The role uses a control-plane Action to read event hubs and a data-plane DataAction to send events; it does not provide receive access or the complete access of Data Owner.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 2b629674-e913-4c01-ae53-ef4638d8f975
Control-plane actions (1)
Microsoft.EventHub/*/eventhubs/read
Data-plane actions (1)
Microsoft.EventHub/*/send/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign at the event hub that receives the producer data or at a namespace when the producer must send to multiple contained event hubs. Resource-group and subscription assignments are inherited by every Event Hubs resource below those scopes.
Common use cases (2)
- Authorize an application, service principal, managed identity, or user to publish events to an approved event hub.
- Separate producer send access from consumer receive access and Event Hubs administration.
Prerequisites (2)
- The producer must authenticate with Microsoft Entra ID and obtain an OAuth 2.0 access token for Event Hubs.
- Identify the event hub or namespace to which the principal is authorized to send before creating the role assignment.
Best practices (3)
- Assign at an individual event hub when the producer sends to only that entity.
- Prefer a managed identity for an Azure-hosted producer instead of storing application credentials or shared access keys.
- Use Data Owner only when the producer also requires complete Event Hubs administration and data access.
Security considerations (3)
- The send DataAction authorizes the principal to publish event data throughout the assigned Event Hubs scope.
- A namespace, resource-group, or subscription assignment permits sending to more event hubs than an event-hub assignment.
- The role does not grant receive access or complete Event Hubs management access by itself.
Assignment guidance
Assign Azure Event Hubs Data Sender to the producer identity on the individual event hub whenever possible, or on the namespace only when it must publish to multiple contained event hubs. Keep receive and complete administration access on separate roles unless the workflow requires them.
Related roles (2)
- Azure Event Hubs Data Owner: Data Owner is the documented complete-access role and is broader than send-only access.
- Azure Event Hubs Data Receiver: Data Receiver is the separate built-in role for consumer identities that receive rather than send events.
Common questions
When should I assign the Azure Event Hubs Data Sender Azure role?
Assign Azure Event Hubs Data Sender when you need to: Authorize an application, service principal, managed identity, or user to publish events to an approved event hub.; and Separate producer send access from consumer receive access and Event Hubs administration.. Practical scope: Assign at the event hub that receives the producer data or at a namespace when the producer must send to multiple contained event hubs. Resource-group and subscription assignments are inherited by every Event Hubs resource below those scopes.
What permissions does the Azure Event Hubs Data Sender Azure role grant?
The role definition grants 2 combined control-plane and data-plane actions. Representative operations include: Microsoft.EventHub/*/eventhubs/read; and Microsoft.EventHub/*/send/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Event Hubs Data Sender Azure role?
Key considerations when assigning Azure Event Hubs Data Sender: The send DataAction authorizes the principal to publish event data throughout the assigned Event Hubs scope.; A namespace, resource-group, or subscription assignment permits sending to more event hubs than an event-hub assignment.; and The role does not grant receive access or complete Event Hubs management access by itself.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Analytics →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Authorize Azure Event Hubs Access With Microsoft Entra ID →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.