Azure Integration built-in role

Azure Relay Owner

Provides full Azure Relay access across control-plane Actions and data-plane DataActions. Its `Microsoft.Relay/*` wildcard includes authorization-rule connection-string retrieval and primary or secondary key regeneration at namespace, Hybrid Connection, WCF Relay, and disaster-recovery scopes.

Control-plane actions (1)

• Microsoft.Relay/*

Data-plane actions (1)

• Microsoft.Relay/*

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign at one Relay entity or namespace according to the required administrative boundary. Resource-group and subscription assignments are inherited by all Relay resources below them and grant complete access across that wider scope.

Common use cases (2)

• Administer a Relay namespace and its Hybrid Connections or WCF Relays while also testing send and listen behavior.
• Authorize a tightly controlled integration platform identity that genuinely needs complete Relay management and data operations.

Prerequisites (3)

• Confirm the principal requires resource administration plus both data directions rather than a single workload path.
• The principal must authenticate with Microsoft Entra ID for Relay data operations.
• Inventory every Relay authorization rule in scope and confirm that connection-string retrieval and key regeneration are approved.

Best practices (3)

• Use Listener or Sender for ordinary workload identities and reserve Owner for a small platform-administration group.
• Assign on the individual namespace or entity instead of a parent scope unless all inherited Relay resources share the same administrator.
• Protect retrieved connection strings and coordinate key regeneration with every client that depends on the affected authorization rule.

Security considerations (3)

• The role can create, modify, and delete Relay resources and can send and receive data through every inherited entity.
• The Relay wildcard can return namespace, Hybrid Connection, WCF Relay, and disaster-recovery authorization-rule keys or connection strings and regenerate applicable primary or secondary keys.
• Compromise combines infrastructure control with both sides of Relay communication.

Assignment guidance

Reserve Azure Relay Owner for the platform administrator on one Relay namespace or entity who is also approved to retrieve and rotate its authorization-rule credentials. Assign Listener and Sender separately to workload identities and avoid parent scope when unrelated Relay resources are present.

Related roles (2)

• Azure Relay Listener: Limits the principal to entity reads and listen access.
• Azure Relay Sender: Limits the principal to entity reads and send access.

Editorial sources (7)

• Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations, Related roles. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-17.

• Authenticate and authorize an application with Microsoft Entra ID to access Azure Relay entities →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Permissions for Integration - Microsoft.Relay →

  Supports: Description, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

Official Microsoft Learn documentation →