Azure Integration built-in role

Azure Service Bus Data Owner

Provides full Azure Service Bus access across control-plane Actions and data-plane DataActions for namespaces and messaging entities. Its `Microsoft.ServiceBus/*` wildcard includes authorization-rule connection-string retrieval and primary or secondary key regeneration for namespaces, queues, topics, and disaster-recovery configurations.

Control-plane actions (1)

• Microsoft.ServiceBus/*

Data-plane actions (1)

• Microsoft.ServiceBus/*

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign at a queue, topic, or topic subscription for one entity, at a namespace for its full topology, or at resource-group or subscription scope for broader inherited access. The Azure portal does not currently support topic-subscription-level assignment.

Common use cases (2)

• Administer Service Bus entities and also send and receive messages where one trusted integration identity genuinely needs the complete workflow.
• Support local development or controlled diagnostics that require both message directions and entity administration.

Prerequisites (3)

• The principal must authenticate with Microsoft Entra ID and obtain an OAuth 2.0 token for `https://servicebus.azure.net`.
• Confirm that complete management plus send and receive authority is required before selecting Data Owner.
• Inventory every Service Bus authorization rule in scope and confirm that connection-string retrieval and key regeneration are approved.

Best practices (3)

• Use Data Sender or Data Receiver for one-direction workload identities and prefer managed identities for Azure-hosted applications.
• Assign at the individual entity or namespace and disable local or SAS authentication when the workload supports Microsoft Entra authentication.
• Protect retrieved connection strings and coordinate key regeneration with every client that uses the affected authorization rule.

Security considerations (4)

• The role combines namespace and entity administration with the ability to send and receive message data throughout its scope.
• The Service Bus wildcard can return namespace, queue, topic, and disaster-recovery authorization-rule connection strings or keys and regenerate applicable primary or secondary keys.
• A namespace, resource-group, or subscription assignment reaches more queues, topics, subscriptions, and filters than an entity assignment.
• Role assignment changes can take up to five minutes to propagate.

Assignment guidance

Assign Azure Service Bus Data Owner only to a trusted principal that needs complete Service Bus administration, messaging access, and authorization-rule credential authority, preferably on one entity or namespace. Use Data Sender and Data Receiver for ordinary producer and consumer identities.

Related roles (2)

• Azure Service Bus Data Sender: Limits the principal to entity reads and message sending.
• Azure Service Bus Data Receiver: Limits the principal to entity reads and message receiving.

Editorial sources (7)

• Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations, Related roles. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-17.

• Authenticate and authorize an application with Microsoft Entra ID to access Azure Service Bus entities →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Permissions for Integration - Microsoft.ServiceBus →

  Supports: Description, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

Official Microsoft Learn documentation →