Azure Integration built-in role
Azure Relay Listener
Provides entity-read control-plane access and the data-plane listen operation for Azure Relay Hybrid Connections and WCF Relays. It does not grant send access or the full management and data access of Azure Relay Owner.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 26e0b698-aa6d-4085-9386-aadae190014d
Control-plane actions (2)
Microsoft.Relay/*/wcfRelays/readMicrosoft.Relay/*/hybridConnections/read
Data-plane actions (1)
Microsoft.Relay/*/listen/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign at one hybrid connection or WCF relay for entity-specific listening, at a Relay namespace for all contained entities, or at resource-group or subscription scope for broader inherited access.
Common use cases (2)
- Authorize a listener application to accept connections or requests on one Relay entity.
- Separate the service process that listens behind a firewall or NAT from clients that send through the Relay.
Prerequisites (2)
- The Relay namespace and target hybrid connection or WCF relay must exist.
- The listener identity must authenticate with Microsoft Entra ID and obtain an OAuth 2.0 token for the `https://relay.azure.net` resource.
Best practices (2)
- Assign at the individual Relay entity when the workload listens on only one hybrid connection or WCF relay.
- Use a managed identity for an Azure-hosted listener so credentials do not need to be stored in code.
Security considerations (2)
- Listen access lets the principal receive Relay connections and requests for every entity in the assigned scope.
- The role does not grant send access, entity changes, or full Relay resource administration.
Assignment guidance
Assign Azure Relay Listener to the listening workload identity on the specific hybrid connection or WCF relay. Use Sender for client applications and Owner only when the same trusted principal genuinely needs complete Relay administration and data access.
Related roles (2)
- Azure Relay Sender: Provides the separate send and entity-read path for Relay clients.
- Azure Relay Owner: Provides full Relay control-plane and data-plane access.
Common questions
When should I assign the Azure Relay Listener Azure role?
Assign Azure Relay Listener when you need to: Authorize a listener application to accept connections or requests on one Relay entity.; and Separate the service process that listens behind a firewall or NAT from clients that send through the Relay.. Practical scope: Assign at one hybrid connection or WCF relay for entity-specific listening, at a Relay namespace for all contained entities, or at resource-group or subscription scope for broader inherited access.
What permissions does the Azure Relay Listener Azure role grant?
The role definition grants 3 combined control-plane and data-plane actions. Representative operations include: Microsoft.Relay/*/wcfRelays/read; Microsoft.Relay/*/hybridConnections/read; and Microsoft.Relay/*/listen/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Relay Listener Azure role?
Key considerations when assigning Azure Relay Listener: Listen access lets the principal receive Relay connections and requests for every entity in the assigned scope.; and The role does not grant send access, entity changes, or full Relay resource administration.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Authenticate and authorize an application with Microsoft Entra ID to access Azure Relay entities →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.