Azure Integration built-in role

EventGrid EventSubscription Contributor

Creates, updates, and deletes Event Grid event subscriptions without granting general topic creation or Event Grid resource administration. The role contains control-plane Actions only and can retrieve subscription information associated with event destinations.

Control-plane actions (9)

• Microsoft.Authorization/*/read
• Microsoft.EventGrid/eventSubscriptions/*
• Microsoft.EventGrid/topicTypes/eventSubscriptions/read
• Microsoft.EventGrid/locations/eventSubscriptions/read
• Microsoft.EventGrid/locations/topicTypes/eventSubscriptions/read
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Support/*

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

For a system topic, assign on the Azure source resource that publishes the events. For a custom topic or domain topic, assign on that topic. Parent assignments inherit subscription-management authority across additional sources.

Common use cases (2)

• Let an integration operator create and maintain event routes for one Azure resource or custom topic without managing the topic itself.
• Delegate event-domain topic subscriptions to a tenant or application team at that domain-topic scope.

Prerequisites (2)

• The event source must exist and the principal must know the approved destination and filtering requirements.
• For a non-webhook destination such as Event Hubs or Queue Storage, the principal also needs write access to that destination resource.

Best practices (2)

• Assign at the source resource or individual topic and use EventSubscription Reader for observation-only duties.
• Review destination ownership, filters, retry policy, and dead-letter configuration before creating or changing a subscription.

Security considerations (4)

• Changing an event subscription can redirect, duplicate, or stop event delivery and can expose events to an unauthorized endpoint.
• Microsoft identifies the full event-subscription endpoint URL operation as potentially secret-bearing and recommends restricting it.
• The role does not create topics or publish events through the Event Grid data plane.
• The published supporting Actions include `Microsoft.Insights/alertRules/*` and `Microsoft.Support/*`; parent scope extends those wildcards beyond the event source or topic.

Assignment guidance

Assign EventGrid EventSubscription Contributor on the specific source resource, custom topic, or domain topic to the routing operator. Grant destination write access separately when required, and use Reader when no route change is needed.

Related roles (2)

• EventGrid EventSubscription Reader: Reads event subscriptions without creating, changing, or deleting them.
• EventGrid Contributor: Adds general Event Grid resource creation and management.

Editorial sources (6)

• Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Authorizing access to Event Grid resources →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →