Azure Integration built-in role

Azure Resource Notifications System Topics Subscriber

Creates Azure Resource Notifications system topics and Event Grid event subscriptions for all currently exposed ARN topic types. The control-plane role is regularly updated to include future ARN topic types and grants no DataActions.

Control-plane actions (10)

• Microsoft.ResourceNotifications/systemTopics/subscribeToResources/action
• Microsoft.ResourceNotifications/systemTopics/subscribeToHealthResources/action
• Microsoft.ResourceNotifications/systemTopics/subscribeToMaintenanceResources/action
• Microsoft.ResourceNotifications/systemTopics/subscribeToComputeResources/action
• Microsoft.ResourceNotifications/systemTopics/subscribeToComputeScheduleResources/action
• Microsoft.ResourceNotifications/systemTopics/subscribeToContainerServiceEventResources/action
• Microsoft.ResourceNotifications/systemTopics/subscribeToImpactReportingResources/action
• Microsoft.ResourceNotifications/systemTopics/subscribeToAksResources/action
• Microsoft.EventGrid/eventSubscriptions/write
• Microsoft.EventGrid/systemTopics/eventSubscriptions/write

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

ARN events are emitted exclusively at Azure subscription scope, so the effective notification boundary is the whole subscription even when the system topic resource is placed in a resource group. The subscribing principal should also have read access across that subscription.

Common use cases (2)

• Create Event Grid subscriptions for subscription-wide Azure resource, health, maintenance, compute, scheduling, container service, impact, or AKS notifications.
• Route approved ARN event streams to operational automation or monitoring endpoints.

Prerequisites (2)

• The principal must have read access across the subscription whose ARN events will be received.
• The destination event handler must exist, and the principal needs the separate write access required to configure that handler when it is not a webhook.

Best practices (2)

• Restrict the role to a small subscription-level event-platform group and use a custom role when only selected ARN topic types are approved.
• Filter subscriptions to the required event types and subjects and review the role whenever Microsoft adds new ARN topic types.

Security considerations (3)

• The assignee can receive comprehensive resource payload notifications across the entire subscription.
• The built-in role automatically expands to future ARN topic types, so its accessible data surface can grow without a new role assignment.
• Event subscription creation can route sensitive operational notifications to downstream endpoints.

Assignment guidance

Assign Azure Resource Notifications System Topics Subscriber only to the subscription-wide event platform identity that creates approved ARN topics and subscriptions. Require subscription read access, secure the destination, and use a custom role when automatic access to all future topic types is unacceptable.

Related roles (2)

• EventGrid EventSubscription Contributor: Manages general Event Grid event subscriptions but does not include the ARN topic-type subscription permissions.
• EventGrid EventSubscription Reader: Reads Event Grid subscriptions without creating ARN system topics or subscriptions.

Editorial sources (7)

• Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →

  Supports: Description, Security considerations, Related roles. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Azure Resource Notifications as an Azure Event Grid source →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Authorizing access to Event Grid resources →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-17.

Official Microsoft Learn documentation →