Azure Integration built-in role

Azure Relay Sender

Provides entity-read control-plane access and the data-plane send operation for Azure Relay Hybrid Connections and WCF Relays. It does not grant listen access or full Relay administration.

Control-plane actions (2)

• Microsoft.Relay/*/wcfRelays/read
• Microsoft.Relay/*/hybridConnections/read

Data-plane actions (1)

• Microsoft.Relay/*/send/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign at one hybrid connection or WCF relay for entity-specific sending, at a Relay namespace for all contained entities, or at resource-group or subscription scope for broader inherited access.

Common use cases (2)

• Authorize a client application to send requests or open connections through one Relay entity.
• Separate sender clients from the service process that listens on the Relay.

Prerequisites (2)

• The Relay namespace and target hybrid connection or WCF relay must exist.
• The sender identity must authenticate with Microsoft Entra ID and obtain an OAuth 2.0 token for the `https://relay.azure.net` resource.

Best practices (2)

• Assign at the individual Relay entity when the workload sends to only one hybrid connection or WCF relay.
• Use a managed identity for an Azure-hosted sender instead of storing client credentials.

Security considerations (2)

• Send access lets the principal initiate Relay traffic for every entity in the assigned scope.
• The role does not grant listen access, entity changes, or full Relay resource administration.

Assignment guidance

Assign Azure Relay Sender to the client workload identity on the specific Relay entity. Use Listener for receiving workloads and Owner only for principals that administer the Relay resources and require both data directions.

Related roles (2)

• Azure Relay Listener: Provides the separate listen and entity-read path for Relay services.
• Azure Relay Owner: Provides full Relay control-plane and data-plane access.

Editorial sources (6)

• Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Authenticate and authorize an application with Microsoft Entra ID to access Azure Relay entities →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →