Azure Integration built-in role

EventGrid Data Sender

Publishes events through the Event Grid data plane while retaining control-plane reads for supported topic resources. It does not grant broad Event Grid resource management or event-subscription administration.

Control-plane actions (6)

• Microsoft.Authorization/*/read
• Microsoft.EventGrid/topics/read
• Microsoft.EventGrid/domains/read
• Microsoft.EventGrid/partnerNamespaces/read
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.EventGrid/namespaces/read

Data-plane actions (1)

• Microsoft.EventGrid/events/send/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Current publisher authorization guidance explicitly permits assignment at management-group, subscription, resource-group, or specific Event Grid topic, domain, or partner-namespace scope. Use the specific publishing target when one of those resource scopes applies; parent scopes permit publication to additional inherited Event Grid resources.

Common use cases (2)

• Authorize an application or managed identity to publish events to one custom topic.
• Separate event publication from topic and subscription administration.

Prerequisites (2)

• The target Event Grid topic, domain, partner namespace, or Event Grid namespace publishing endpoint must already exist.
• The publisher identity and event schema, source validation, and delivery expectations must be approved for the target topic.

Best practices (2)

• Assign directly on the publishing target and use a managed identity when the producer runs in Azure.
• Keep topic keys and broad Event Grid management away from a publisher that only needs the data-plane send operation.

Security considerations (2)

• The send DataAction lets the principal inject events into every supported Event Grid target in its assigned scope.
• Published events can trigger downstream automation, cost, and business side effects even though the role cannot manage subscriptions.

Assignment guidance

Assign EventGrid Data Sender to the producer security principal on the specific topic, domain, or partner namespace when that documented resource scope applies. The namespace authentication workflow also requires this role for its publisher, but current guidance does not state a finer namespace-resource assignment scope; do not claim one from the role's namespace read Action. Use EventGrid Contributor for infrastructure administration and EventSubscription Contributor for routing changes.

Related roles (2)

• EventGrid Contributor: Manages Event Grid resources rather than providing a publisher-only boundary.
• EventGrid EventSubscription Contributor: Manages event routes without granting the dedicated event-publishing DataAction.

Editorial sources (8)

• Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →

  Supports: Description, Security considerations, Related roles. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-17.

• Authorizing access to Event Grid resources →

  Supports: Related roles. Retrieved 2026-07-17.

• Authentication and authorization with Microsoft Entra ID →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Authentication and authorization with Microsoft Entra ID when using Event Grid namespaces →

  Supports: Description, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

Official Microsoft Learn documentation →