Azure Integration built-in role
EventGrid TopicSpaces Publisher
Authorizes an MQTT v5 client using a Microsoft Entra JWT to publish messages to Event Grid topic spaces. It combines Event Grid and Azure resource metadata reads, a write-capable classic alert-rule wildcard, and the topic-space publish DataAction; it does not grant subscribe access.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: a12b0b94-b317-4dcd-84a8-502ce99884c6
Control-plane actions (5)
Microsoft.Authorization/*/readMicrosoft.EventGrid/*/readMicrosoft.Insights/alertRules/*Microsoft.Resources/deployments/readMicrosoft.Resources/subscriptions/resourceGroups/read
Data-plane actions (1)
Microsoft.EventGrid/topicSpaces/publish/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on one Event Grid topic space for that topic-space boundary, or on the namespace when the identity must publish across all topic spaces. Resource-group and subscription scopes inherit more broadly.
Common use cases (2)
- Authorize an MQTT v5 device, application, or service principal to publish messages to one approved topic space.
- Separate MQTT publisher identities from subscribers and namespace administrators.
Prerequisites (2)
- An Event Grid namespace with MQTT enabled and the target topic space must exist.
- The client must use MQTT v5, authenticate with a Microsoft Entra JWT, and set the token audience to `https://eventgrid.azure.net/`.
Best practices (3)
- Assign at topic-space scope and use a dedicated service principal or managed identity for each publisher trust boundary.
- Use the Subscriber role separately and avoid namespace scope unless publication to every topic space is required.
- Keep the assignment at topic-space scope so the classic alert-rule wildcard is not inherited across unrelated resources in a resource group or subscription.
Security considerations (4)
- The publish DataAction lets the identity inject MQTT messages into every topic space covered by the assignment.
- Namespace or parent scope increases the message-publication surface beyond one topic space.
- The control-plane Actions are not all reads: `Microsoft.Insights/alertRules/*` can manage classic alert rules throughout the effective assignment scope.
- The role does not grant MQTT subscribe access.
Assignment guidance
Assign EventGrid TopicSpaces Publisher to the MQTT v5 publisher identity on the specific topic space. Use namespace scope only for an approved multi-topic-space publisher and grant Subscriber separately to identities that consume messages.
Related roles (2)
- EventGrid TopicSpaces Subscriber: Provides the separate MQTT topic-space subscription DataAction.
- EventGrid Data Sender: Publishes Event Grid events through the event data plane rather than MQTT topic spaces.
Common questions
When should I assign the EventGrid TopicSpaces Publisher Azure role?
Assign EventGrid TopicSpaces Publisher when you need to: Authorize an MQTT v5 device, application, or service principal to publish messages to one approved topic space.; and Separate MQTT publisher identities from subscribers and namespace administrators.. Practical scope: Assign on one Event Grid topic space for that topic-space boundary, or on the namespace when the identity must publish across all topic spaces. Resource-group and subscription scopes inherit more broadly.
What permissions does the EventGrid TopicSpaces Publisher Azure role grant?
The role definition grants 6 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.EventGrid/*/read; Microsoft.Insights/alertRules/*; Microsoft.Resources/deployments/read; Microsoft.Resources/subscriptions/resourceGroups/read; and Microsoft.EventGrid/topicSpaces/publish/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the EventGrid TopicSpaces Publisher Azure role?
Key considerations when assigning EventGrid TopicSpaces Publisher: The publish DataAction lets the identity inject MQTT messages into every topic space covered by the assignment.; Namespace or parent scope increases the message-publication surface beyond one topic space.; The control-plane Actions are not all reads: `Microsoft.Insights/alertRules/*` can manage classic alert rules throughout the effective assignment scope.; and The role does not grant MQTT subscribe access.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Best practices, Security considerations, Related roles. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Microsoft Entra JWT authentication and Azure RBAC authorization to publish or subscribe MQTT messages →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.