Azure Integration built-in role
Azure Service Bus Data Owner
Provides full Azure Service Bus access across control-plane Actions and data-plane DataActions for namespaces and messaging entities. Its `Microsoft.ServiceBus/*` wildcard includes authorization-rule connection-string retrieval and primary or secondary key regeneration for namespaces, queues, topics, and disaster-recovery configurations.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 090c5cfd-751d-490a-894a-3ce6f1109419
Control-plane actions (1)
Microsoft.ServiceBus/*
Data-plane actions (1)
Microsoft.ServiceBus/*
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign at a queue, topic, or topic subscription for one entity, at a namespace for its full topology, or at resource-group or subscription scope for broader inherited access. The Azure portal does not currently support topic-subscription-level assignment.
Common use cases (2)
- Administer Service Bus entities and also send and receive messages where one trusted integration identity genuinely needs the complete workflow.
- Support local development or controlled diagnostics that require both message directions and entity administration.
Prerequisites (3)
- The principal must authenticate with Microsoft Entra ID and obtain an OAuth 2.0 token for `https://servicebus.azure.net`.
- Confirm that complete management plus send and receive authority is required before selecting Data Owner.
- Inventory every Service Bus authorization rule in scope and confirm that connection-string retrieval and key regeneration are approved.
Best practices (3)
- Use Data Sender or Data Receiver for one-direction workload identities and prefer managed identities for Azure-hosted applications.
- Assign at the individual entity or namespace and disable local or SAS authentication when the workload supports Microsoft Entra authentication.
- Protect retrieved connection strings and coordinate key regeneration with every client that uses the affected authorization rule.
Security considerations (4)
- The role combines namespace and entity administration with the ability to send and receive message data throughout its scope.
- The Service Bus wildcard can return namespace, queue, topic, and disaster-recovery authorization-rule connection strings or keys and regenerate applicable primary or secondary keys.
- A namespace, resource-group, or subscription assignment reaches more queues, topics, subscriptions, and filters than an entity assignment.
- Role assignment changes can take up to five minutes to propagate.
Assignment guidance
Assign Azure Service Bus Data Owner only to a trusted principal that needs complete Service Bus administration, messaging access, and authorization-rule credential authority, preferably on one entity or namespace. Use Data Sender and Data Receiver for ordinary producer and consumer identities.
Related roles (2)
- Azure Service Bus Data Sender: Limits the principal to entity reads and message sending.
- Azure Service Bus Data Receiver: Limits the principal to entity reads and message receiving.
Common questions
When should I assign the Azure Service Bus Data Owner Azure role?
Assign Azure Service Bus Data Owner when you need to: Administer Service Bus entities and also send and receive messages where one trusted integration identity genuinely needs the complete workflow.; and Support local development or controlled diagnostics that require both message directions and entity administration.. Practical scope: Assign at a queue, topic, or topic subscription for one entity, at a namespace for its full topology, or at resource-group or subscription scope for broader inherited access. The Azure portal does not currently support topic-subscription-level assignment.
What permissions does the Azure Service Bus Data Owner Azure role grant?
The role definition grants 2 combined control-plane and data-plane actions. Representative operations include: Microsoft.ServiceBus/*; and Microsoft.ServiceBus/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Service Bus Data Owner Azure role?
Key considerations when assigning Azure Service Bus Data Owner: The role combines namespace and entity administration with the ability to send and receive message data throughout its scope.; The Service Bus wildcard can return namespace, queue, topic, and disaster-recovery authorization-rule connection strings or keys and regenerate applicable primary or secondary keys.; A namespace, resource-group, or subscription assignment reaches more queues, topics, subscriptions, and filters than an entity assignment.; and Role assignment changes can take up to five minutes to propagate.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations, Related roles. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-17.
- Authenticate and authorize an application with Microsoft Entra ID to access Azure Service Bus entities →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Permissions for Integration - Microsoft.ServiceBus →
Supports: Description, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.