Azure Integration built-in role
Azure Service Bus Data Receiver
Reads Service Bus entity metadata through control-plane Actions and receives messages through a data-plane DataAction. It does not grant send access or the complete administration and data access of Data Owner.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 4f6d3b9b-027b-4f4c-9142-0e5a2a2247e0
Control-plane actions (3)
Microsoft.ServiceBus/*/queues/readMicrosoft.ServiceBus/*/topics/readMicrosoft.ServiceBus/*/topics/subscriptions/read
Data-plane actions (1)
Microsoft.ServiceBus/*/receive/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign at the queue or topic subscription consumed by the identity, at a namespace for all contained entities, or at a broader inherited scope. Topic-subscription-level assignment requires tooling other than the Azure portal.
Common use cases (2)
- Authorize a worker or application to receive messages from one queue.
- Authorize a subscriber application to consume messages from one topic subscription without send access.
Prerequisites (2)
- The queue or topic subscription must exist and the consumer must authenticate with Microsoft Entra ID for Service Bus.
- Choose the specific entity or namespace that matches the intended receive boundary.
Best practices (2)
- Assign directly on the queue or topic subscription and use a managed identity for an Azure-hosted consumer.
- Disable local or SAS authentication when compatible and use Data Owner only when the consumer also requires administration or send access.
Security considerations (2)
- Receive access exposes message bodies and properties available on every queue or subscription in the assigned scope.
- The role cannot send messages or fully administer Service Bus resources.
Assignment guidance
Assign Azure Service Bus Data Receiver to the consumer identity on the individual queue or topic subscription. Use command-line or template tooling for topic-subscription scope, and broaden to the namespace only when the consumer must receive from multiple entities.
Related roles (2)
- Azure Service Bus Data Sender: Provides the separate producer path for sending messages.
- Azure Service Bus Data Owner: Adds complete Service Bus management, send, and receive access.
Editorial sources (6)
- Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Authenticate and authorize an application with Microsoft Entra ID to access Azure Service Bus entities →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.