Azure Integration built-in role
Azure Resource Notifications System Topics Subscriber
Creates Azure Resource Notifications system topics and Event Grid event subscriptions for all currently exposed ARN topic types. The control-plane role is regularly updated to include future ARN topic types and grants no DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 0b962ed2-6d56-471c-bd5f-3477d83a7ba4
Control-plane actions (10)
Microsoft.ResourceNotifications/systemTopics/subscribeToResources/actionMicrosoft.ResourceNotifications/systemTopics/subscribeToHealthResources/actionMicrosoft.ResourceNotifications/systemTopics/subscribeToMaintenanceResources/actionMicrosoft.ResourceNotifications/systemTopics/subscribeToComputeResources/actionMicrosoft.ResourceNotifications/systemTopics/subscribeToComputeScheduleResources/actionMicrosoft.ResourceNotifications/systemTopics/subscribeToContainerServiceEventResources/actionMicrosoft.ResourceNotifications/systemTopics/subscribeToImpactReportingResources/actionMicrosoft.ResourceNotifications/systemTopics/subscribeToAksResources/actionMicrosoft.EventGrid/eventSubscriptions/writeMicrosoft.EventGrid/systemTopics/eventSubscriptions/write
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
ARN events are emitted exclusively at Azure subscription scope, so the effective notification boundary is the whole subscription even when the system topic resource is placed in a resource group. The subscribing principal should also have read access across that subscription.
Common use cases (2)
- Create Event Grid subscriptions for subscription-wide Azure resource, health, maintenance, compute, scheduling, container service, impact, or AKS notifications.
- Route approved ARN event streams to operational automation or monitoring endpoints.
Prerequisites (2)
- The principal must have read access across the subscription whose ARN events will be received.
- The destination event handler must exist, and the principal needs the separate write access required to configure that handler when it is not a webhook.
Best practices (2)
- Restrict the role to a small subscription-level event-platform group and use a custom role when only selected ARN topic types are approved.
- Filter subscriptions to the required event types and subjects and review the role whenever Microsoft adds new ARN topic types.
Security considerations (3)
- The assignee can receive comprehensive resource payload notifications across the entire subscription.
- The built-in role automatically expands to future ARN topic types, so its accessible data surface can grow without a new role assignment.
- Event subscription creation can route sensitive operational notifications to downstream endpoints.
Assignment guidance
Assign Azure Resource Notifications System Topics Subscriber only to the subscription-wide event platform identity that creates approved ARN topics and subscriptions. Require subscription read access, secure the destination, and use a custom role when automatic access to all future topic types is unacceptable.
Related roles (2)
- EventGrid EventSubscription Contributor: Manages general Event Grid event subscriptions but does not include the ARN topic-type subscription permissions.
- EventGrid EventSubscription Reader: Reads Event Grid subscriptions without creating ARN system topics or subscriptions.
Common questions
When should I assign the Azure Resource Notifications System Topics Subscriber Azure role?
Assign Azure Resource Notifications System Topics Subscriber when you need to: Create Event Grid subscriptions for subscription-wide Azure resource, health, maintenance, compute, scheduling, container service, impact, or AKS notifications.; and Route approved ARN event streams to operational automation or monitoring endpoints.. Practical scope: ARN events are emitted exclusively at Azure subscription scope, so the effective notification boundary is the whole subscription even when the system topic resource is placed in a resource group. The subscribing principal should also have read access across that subscription.
What permissions does the Azure Resource Notifications System Topics Subscriber Azure role grant?
The role definition grants 10 combined control-plane and data-plane actions. Representative operations include: Microsoft.ResourceNotifications/systemTopics/subscribeToResources/action; Microsoft.ResourceNotifications/systemTopics/subscribeToHealthResources/action; Microsoft.ResourceNotifications/systemTopics/subscribeToMaintenanceResources/action; Microsoft.ResourceNotifications/systemTopics/subscribeToComputeResources/action; Microsoft.ResourceNotifications/systemTopics/subscribeToComputeScheduleResources/action; and Microsoft.ResourceNotifications/systemTopics/subscribeToContainerServiceEventResources/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Resource Notifications System Topics Subscriber Azure role?
Key considerations when assigning Azure Resource Notifications System Topics Subscriber: The assignee can receive comprehensive resource payload notifications across the entire subscription.; The built-in role automatically expands to future ARN topic types, so its accessible data surface can grow without a new role assignment.; and Event subscription creation can route sensitive operational notifications to downstream endpoints.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations, Related roles. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Azure Resource Notifications as an Azure Event Grid source →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Authorizing access to Event Grid resources →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-17.