Azure Integration built-in role

EventGrid TopicSpaces Publisher

Authorizes an MQTT v5 client using a Microsoft Entra JWT to publish messages to Event Grid topic spaces. It combines Event Grid and Azure resource metadata reads, a write-capable classic alert-rule wildcard, and the topic-space publish DataAction; it does not grant subscribe access.

Control-plane actions (5)

• Microsoft.Authorization/*/read
• Microsoft.EventGrid/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/deployments/read
• Microsoft.Resources/subscriptions/resourceGroups/read

Data-plane actions (1)

• Microsoft.EventGrid/topicSpaces/publish/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on one Event Grid topic space for that topic-space boundary, or on the namespace when the identity must publish across all topic spaces. Resource-group and subscription scopes inherit more broadly.

Common use cases (2)

• Authorize an MQTT v5 device, application, or service principal to publish messages to one approved topic space.
• Separate MQTT publisher identities from subscribers and namespace administrators.

Prerequisites (2)

• An Event Grid namespace with MQTT enabled and the target topic space must exist.
• The client must use MQTT v5, authenticate with a Microsoft Entra JWT, and set the token audience to `https://eventgrid.azure.net/`.

Best practices (3)

• Assign at topic-space scope and use a dedicated service principal or managed identity for each publisher trust boundary.
• Use the Subscriber role separately and avoid namespace scope unless publication to every topic space is required.
• Keep the assignment at topic-space scope so the classic alert-rule wildcard is not inherited across unrelated resources in a resource group or subscription.

Security considerations (4)

• The publish DataAction lets the identity inject MQTT messages into every topic space covered by the assignment.
• Namespace or parent scope increases the message-publication surface beyond one topic space.
• The control-plane Actions are not all reads: `Microsoft.Insights/alertRules/*` can manage classic alert rules throughout the effective assignment scope.
• The role does not grant MQTT subscribe access.

Assignment guidance

Assign EventGrid TopicSpaces Publisher to the MQTT v5 publisher identity on the specific topic space. Use namespace scope only for an approved multi-topic-space publisher and grant Subscriber separately to identities that consume messages.

Related roles (2)

• EventGrid TopicSpaces Subscriber: Provides the separate MQTT topic-space subscription DataAction.
• EventGrid Data Sender: Publishes Event Grid events through the event data plane rather than MQTT topic spaces.

Editorial sources (6)

• Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Best practices, Security considerations, Related roles. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Microsoft Entra JWT authentication and Azure RBAC authorization to publish or subscribe MQTT messages →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →