Azure Integration built-in role
Azure Service Bus Data Receiver
Reads Service Bus entity metadata through control-plane Actions and receives messages through a data-plane DataAction. It does not grant send access or the complete administration and data access of Data Owner.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 4f6d3b9b-027b-4f4c-9142-0e5a2a2247e0
Control-plane actions (3)
Microsoft.ServiceBus/*/queues/readMicrosoft.ServiceBus/*/topics/readMicrosoft.ServiceBus/*/topics/subscriptions/read
Data-plane actions (1)
Microsoft.ServiceBus/*/receive/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign at the queue or topic subscription consumed by the identity, at a namespace for all contained entities, or at a broader inherited scope. Topic-subscription-level assignment requires tooling other than the Azure portal.
Common use cases (2)
- Authorize a worker or application to receive messages from one queue.
- Authorize a subscriber application to consume messages from one topic subscription without send access.
Prerequisites (2)
- The queue or topic subscription must exist and the consumer must authenticate with Microsoft Entra ID for Service Bus.
- Choose the specific entity or namespace that matches the intended receive boundary.
Best practices (2)
- Assign directly on the queue or topic subscription and use a managed identity for an Azure-hosted consumer.
- Disable local or SAS authentication when compatible and use Data Owner only when the consumer also requires administration or send access.
Security considerations (2)
- Receive access exposes message bodies and properties available on every queue or subscription in the assigned scope.
- The role cannot send messages or fully administer Service Bus resources.
Assignment guidance
Assign Azure Service Bus Data Receiver to the consumer identity on the individual queue or topic subscription. Use command-line or template tooling for topic-subscription scope, and broaden to the namespace only when the consumer must receive from multiple entities.
Related roles (2)
- Azure Service Bus Data Sender: Provides the separate producer path for sending messages.
- Azure Service Bus Data Owner: Adds complete Service Bus management, send, and receive access.
Common questions
When should I assign the Azure Service Bus Data Receiver Azure role?
Assign Azure Service Bus Data Receiver when you need to: Authorize a worker or application to receive messages from one queue.; and Authorize a subscriber application to consume messages from one topic subscription without send access.. Practical scope: Assign at the queue or topic subscription consumed by the identity, at a namespace for all contained entities, or at a broader inherited scope. Topic-subscription-level assignment requires tooling other than the Azure portal.
What permissions does the Azure Service Bus Data Receiver Azure role grant?
The role definition grants 4 combined control-plane and data-plane actions. Representative operations include: Microsoft.ServiceBus/*/queues/read; Microsoft.ServiceBus/*/topics/read; Microsoft.ServiceBus/*/topics/subscriptions/read; and Microsoft.ServiceBus/*/receive/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Service Bus Data Receiver Azure role?
Key considerations when assigning Azure Service Bus Data Receiver: Receive access exposes message bodies and properties available on every queue or subscription in the assigned scope.; and The role cannot send messages or fully administer Service Bus resources.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Authenticate and authorize an application with Microsoft Entra ID to access Azure Service Bus entities →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.