Azure Integration built-in role
EventGrid TopicSpaces Subscriber
Authorizes an MQTT v5 client using a Microsoft Entra JWT to subscribe to messages in Event Grid topic spaces. It combines Event Grid and Azure resource metadata reads, a write-capable classic alert-rule wildcard, and the topic-space subscribe DataAction; it does not grant publish access.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 4b0f2fd7-60b4-4eca-896f-4435034f8bf5
Control-plane actions (5)
Microsoft.Authorization/*/readMicrosoft.EventGrid/*/readMicrosoft.Insights/alertRules/*Microsoft.Resources/deployments/readMicrosoft.Resources/subscriptions/resourceGroups/read
Data-plane actions (1)
Microsoft.EventGrid/topicSpaces/subscribe/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on one Event Grid topic space for that subscription boundary, or on the namespace when the identity must subscribe across all topic spaces. Resource-group and subscription scopes inherit more broadly.
Common use cases (2)
- Authorize an MQTT v5 application or service principal to consume messages from one approved topic space.
- Separate MQTT subscriber identities from publishers and namespace administrators.
Prerequisites (2)
- An Event Grid namespace with MQTT enabled and the target topic space must exist.
- The client must use MQTT v5, authenticate with a Microsoft Entra JWT, and set the token audience to `https://eventgrid.azure.net/`.
Best practices (3)
- Assign at topic-space scope and use a dedicated service principal or managed identity for each subscriber trust boundary.
- Use the Publisher role separately and avoid namespace scope unless subscription across every topic space is required.
- Keep the assignment at topic-space scope so the classic alert-rule wildcard is not inherited across unrelated resources in a resource group or subscription.
Security considerations (4)
- The subscribe DataAction exposes MQTT messages available through every topic space covered by the assignment.
- Namespace or parent scope increases the message-consumption surface beyond one topic space.
- The control-plane Actions are not all reads: `Microsoft.Insights/alertRules/*` can manage classic alert rules throughout the effective assignment scope.
- The role does not grant MQTT publish access.
Assignment guidance
Assign EventGrid TopicSpaces Subscriber to the MQTT v5 consumer identity on the specific topic space. Use namespace scope only for an approved multi-topic-space subscriber and grant Publisher separately to identities that send messages.
Related roles (2)
- EventGrid TopicSpaces Publisher: Provides the separate MQTT topic-space publication DataAction.
- EventGrid EventSubscription Reader: Reads Event Grid event-subscription resources rather than consuming MQTT messages.
Common questions
When should I assign the EventGrid TopicSpaces Subscriber Azure role?
Assign EventGrid TopicSpaces Subscriber when you need to: Authorize an MQTT v5 application or service principal to consume messages from one approved topic space.; and Separate MQTT subscriber identities from publishers and namespace administrators.. Practical scope: Assign on one Event Grid topic space for that subscription boundary, or on the namespace when the identity must subscribe across all topic spaces. Resource-group and subscription scopes inherit more broadly.
What permissions does the EventGrid TopicSpaces Subscriber Azure role grant?
The role definition grants 6 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.EventGrid/*/read; Microsoft.Insights/alertRules/*; Microsoft.Resources/deployments/read; Microsoft.Resources/subscriptions/resourceGroups/read; and Microsoft.EventGrid/topicSpaces/subscribe/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the EventGrid TopicSpaces Subscriber Azure role?
Key considerations when assigning EventGrid TopicSpaces Subscriber: The subscribe DataAction exposes MQTT messages available through every topic space covered by the assignment.; Namespace or parent scope increases the message-consumption surface beyond one topic space.; The control-plane Actions are not all reads: `Microsoft.Insights/alertRules/*` can manage classic alert rules throughout the effective assignment scope.; and The role does not grant MQTT publish access.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Best practices, Security considerations, Related roles. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Microsoft Entra JWT authentication and Azure RBAC authorization to publish or subscribe MQTT messages →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.