Azure Integration built-in role
EventGrid Data Sender
Publishes events through the Event Grid data plane while retaining control-plane reads for supported topic resources. It does not grant broad Event Grid resource management or event-subscription administration.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: d5a91429-5739-47e2-a06b-3470a27159e7
Control-plane actions (6)
Microsoft.Authorization/*/readMicrosoft.EventGrid/topics/readMicrosoft.EventGrid/domains/readMicrosoft.EventGrid/partnerNamespaces/readMicrosoft.Resources/subscriptions/resourceGroups/readMicrosoft.EventGrid/namespaces/read
Data-plane actions (1)
Microsoft.EventGrid/events/send/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Current publisher authorization guidance explicitly permits assignment at management-group, subscription, resource-group, or specific Event Grid topic, domain, or partner-namespace scope. Use the specific publishing target when one of those resource scopes applies; parent scopes permit publication to additional inherited Event Grid resources.
Common use cases (2)
- Authorize an application or managed identity to publish events to one custom topic.
- Separate event publication from topic and subscription administration.
Prerequisites (2)
- The target Event Grid topic, domain, partner namespace, or Event Grid namespace publishing endpoint must already exist.
- The publisher identity and event schema, source validation, and delivery expectations must be approved for the target topic.
Best practices (2)
- Assign directly on the publishing target and use a managed identity when the producer runs in Azure.
- Keep topic keys and broad Event Grid management away from a publisher that only needs the data-plane send operation.
Security considerations (2)
- The send DataAction lets the principal inject events into every supported Event Grid target in its assigned scope.
- Published events can trigger downstream automation, cost, and business side effects even though the role cannot manage subscriptions.
Assignment guidance
Assign EventGrid Data Sender to the producer security principal on the specific topic, domain, or partner namespace when that documented resource scope applies. The namespace authentication workflow also requires this role for its publisher, but current guidance does not state a finer namespace-resource assignment scope; do not claim one from the role's namespace read Action. Use EventGrid Contributor for infrastructure administration and EventSubscription Contributor for routing changes.
Related roles (2)
- EventGrid Contributor: Manages Event Grid resources rather than providing a publisher-only boundary.
- EventGrid EventSubscription Contributor: Manages event routes without granting the dedicated event-publishing DataAction.
Common questions
When should I assign the EventGrid Data Sender Azure role?
Assign EventGrid Data Sender when you need to: Authorize an application or managed identity to publish events to one custom topic.; and Separate event publication from topic and subscription administration.. Practical scope: Current publisher authorization guidance explicitly permits assignment at management-group, subscription, resource-group, or specific Event Grid topic, domain, or partner-namespace scope. Use the specific publishing target when one of those resource scopes applies; parent scopes permit publication to additional inherited Event Grid resources.
What permissions does the EventGrid Data Sender Azure role grant?
The role definition grants 7 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.EventGrid/topics/read; Microsoft.EventGrid/domains/read; Microsoft.EventGrid/partnerNamespaces/read; Microsoft.Resources/subscriptions/resourceGroups/read; and Microsoft.EventGrid/namespaces/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the EventGrid Data Sender Azure role?
Key considerations when assigning EventGrid Data Sender: The send DataAction lets the principal inject events into every supported Event Grid target in its assigned scope.; and Published events can trigger downstream automation, cost, and business side effects even though the role cannot manage subscriptions.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (8)
- Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations, Related roles. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-17.
- Authorizing access to Event Grid resources →
Supports: Related roles. Retrieved 2026-07-17.
- Authentication and authorization with Microsoft Entra ID →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.
- Authentication and authorization with Microsoft Entra ID when using Event Grid namespaces →
Supports: Description, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.