Azure Integration built-in role

EventGrid TopicSpaces Subscriber

Authorizes an MQTT v5 client using a Microsoft Entra JWT to subscribe to messages in Event Grid topic spaces. It combines Event Grid and Azure resource metadata reads, a write-capable classic alert-rule wildcard, and the topic-space subscribe DataAction; it does not grant publish access.

Control-plane actions (5)

• Microsoft.Authorization/*/read
• Microsoft.EventGrid/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/deployments/read
• Microsoft.Resources/subscriptions/resourceGroups/read

Data-plane actions (1)

• Microsoft.EventGrid/topicSpaces/subscribe/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on one Event Grid topic space for that subscription boundary, or on the namespace when the identity must subscribe across all topic spaces. Resource-group and subscription scopes inherit more broadly.

Common use cases (2)

• Authorize an MQTT v5 application or service principal to consume messages from one approved topic space.
• Separate MQTT subscriber identities from publishers and namespace administrators.

Prerequisites (2)

• An Event Grid namespace with MQTT enabled and the target topic space must exist.
• The client must use MQTT v5, authenticate with a Microsoft Entra JWT, and set the token audience to `https://eventgrid.azure.net/`.

Best practices (3)

• Assign at topic-space scope and use a dedicated service principal or managed identity for each subscriber trust boundary.
• Use the Publisher role separately and avoid namespace scope unless subscription across every topic space is required.
• Keep the assignment at topic-space scope so the classic alert-rule wildcard is not inherited across unrelated resources in a resource group or subscription.

Security considerations (4)

• The subscribe DataAction exposes MQTT messages available through every topic space covered by the assignment.
• Namespace or parent scope increases the message-consumption surface beyond one topic space.
• The control-plane Actions are not all reads: `Microsoft.Insights/alertRules/*` can manage classic alert rules throughout the effective assignment scope.
• The role does not grant MQTT publish access.

Assignment guidance

Assign EventGrid TopicSpaces Subscriber to the MQTT v5 consumer identity on the specific topic space. Use namespace scope only for an approved multi-topic-space subscriber and grant Publisher separately to identities that send messages.

Related roles (2)

• EventGrid TopicSpaces Publisher: Provides the separate MQTT topic-space publication DataAction.
• EventGrid EventSubscription Reader: Reads Event Grid event-subscription resources rather than consuming MQTT messages.

Editorial sources (6)

• Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Best practices, Security considerations, Related roles. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Microsoft Entra JWT authentication and Azure RBAC authorization to publish or subscribe MQTT messages →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →