Azure Integration built-in role
EventGrid EventSubscription Contributor
Creates, updates, and deletes Event Grid event subscriptions without granting general topic creation or Event Grid resource administration. The role contains control-plane Actions only and can retrieve subscription information associated with event destinations.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 428e0ff0-5e57-4d9c-a221-2c70d0e0a443
Control-plane actions (9)
Microsoft.Authorization/*/readMicrosoft.EventGrid/eventSubscriptions/*Microsoft.EventGrid/topicTypes/eventSubscriptions/readMicrosoft.EventGrid/locations/eventSubscriptions/readMicrosoft.EventGrid/locations/topicTypes/eventSubscriptions/readMicrosoft.Insights/alertRules/*Microsoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.Support/*
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
For a system topic, assign on the Azure source resource that publishes the events. For a custom topic or domain topic, assign on that topic. Parent assignments inherit subscription-management authority across additional sources.
Common use cases (2)
- Let an integration operator create and maintain event routes for one Azure resource or custom topic without managing the topic itself.
- Delegate event-domain topic subscriptions to a tenant or application team at that domain-topic scope.
Prerequisites (2)
- The event source must exist and the principal must know the approved destination and filtering requirements.
- For a non-webhook destination such as Event Hubs or Queue Storage, the principal also needs write access to that destination resource.
Best practices (2)
- Assign at the source resource or individual topic and use EventSubscription Reader for observation-only duties.
- Review destination ownership, filters, retry policy, and dead-letter configuration before creating or changing a subscription.
Security considerations (4)
- Changing an event subscription can redirect, duplicate, or stop event delivery and can expose events to an unauthorized endpoint.
- Microsoft identifies the full event-subscription endpoint URL operation as potentially secret-bearing and recommends restricting it.
- The role does not create topics or publish events through the Event Grid data plane.
- The published supporting Actions include `Microsoft.Insights/alertRules/*` and `Microsoft.Support/*`; parent scope extends those wildcards beyond the event source or topic.
Assignment guidance
Assign EventGrid EventSubscription Contributor on the specific source resource, custom topic, or domain topic to the routing operator. Grant destination write access separately when required, and use Reader when no route change is needed.
Related roles (2)
- EventGrid EventSubscription Reader: Reads event subscriptions without creating, changing, or deleting them.
- EventGrid Contributor: Adds general Event Grid resource creation and management.
Common questions
When should I assign the EventGrid EventSubscription Contributor Azure role?
Assign EventGrid EventSubscription Contributor when you need to: Let an integration operator create and maintain event routes for one Azure resource or custom topic without managing the topic itself.; and Delegate event-domain topic subscriptions to a tenant or application team at that domain-topic scope.. Practical scope: For a system topic, assign on the Azure source resource that publishes the events. For a custom topic or domain topic, assign on that topic. Parent assignments inherit subscription-management authority across additional sources.
What permissions does the EventGrid EventSubscription Contributor Azure role grant?
The role definition grants 9 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.EventGrid/eventSubscriptions/*; Microsoft.EventGrid/topicTypes/eventSubscriptions/read; Microsoft.EventGrid/locations/eventSubscriptions/read; Microsoft.EventGrid/locations/topicTypes/eventSubscriptions/read; and Microsoft.Insights/alertRules/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the EventGrid EventSubscription Contributor Azure role?
Key considerations when assigning EventGrid EventSubscription Contributor: Changing an event subscription can redirect, duplicate, or stop event delivery and can expose events to an unauthorized endpoint.; Microsoft identifies the full event-subscription endpoint URL operation as potentially secret-bearing and recommends restricting it.; The role does not create topics or publish events through the Event Grid data plane.; and The published supporting Actions include `Microsoft.Insights/alertRules/*` and `Microsoft.Support/*`; parent scope extends those wildcards beyond the event source or topic.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Authorizing access to Event Grid resources →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.