Azure Integration built-in role
Azure Service Bus Data Sender
Reads Service Bus queue, topic, and subscription metadata through control-plane Actions and sends messages through a data-plane DataAction. It does not grant receive access or the complete administration and data access of Data Owner.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 69a216fc-b8fb-44d8-bc22-1f3c2cd27a39
Control-plane actions (3)
Microsoft.ServiceBus/*/queues/readMicrosoft.ServiceBus/*/topics/readMicrosoft.ServiceBus/*/topics/subscriptions/read
Data-plane actions (1)
Microsoft.ServiceBus/*/send/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign at the queue or topic that receives the producer's messages, at a namespace for all contained entities, or at resource-group or subscription scope for broader inherited access.
Common use cases (2)
- Authorize a producer application to send messages to one queue.
- Authorize a publisher application to send messages to one topic without receive or administration authority.
Prerequisites (2)
- The target queue or topic must exist and the producer must authenticate with Microsoft Entra ID for Service Bus.
- Identify the individual entity or namespace the producer is allowed to use before assigning the role.
Best practices (2)
- Assign directly on the queue or topic and use a managed identity for an Azure-hosted producer.
- Disable local or SAS authentication when compatible and use Data Owner only when the producer also requires receive or administration access.
Security considerations (2)
- Send access lets the principal inject messages into every queue or topic in the assigned scope, affecting downstream processing and cost.
- The role cannot receive messages or fully administer Service Bus resources.
Assignment guidance
Assign Azure Service Bus Data Sender to the producer identity on the individual queue or topic whenever possible. Broaden to namespace scope only when the same producer must send to multiple entities.
Related roles (2)
- Azure Service Bus Data Receiver: Provides the separate consumer path for receiving messages.
- Azure Service Bus Data Owner: Adds complete Service Bus management, send, and receive access.
Common questions
When should I assign the Azure Service Bus Data Sender Azure role?
Assign Azure Service Bus Data Sender when you need to: Authorize a producer application to send messages to one queue.; and Authorize a publisher application to send messages to one topic without receive or administration authority.. Practical scope: Assign at the queue or topic that receives the producer's messages, at a namespace for all contained entities, or at resource-group or subscription scope for broader inherited access.
What permissions does the Azure Service Bus Data Sender Azure role grant?
The role definition grants 4 combined control-plane and data-plane actions. Representative operations include: Microsoft.ServiceBus/*/queues/read; Microsoft.ServiceBus/*/topics/read; Microsoft.ServiceBus/*/topics/subscriptions/read; and Microsoft.ServiceBus/*/send/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Service Bus Data Sender Azure role?
Key considerations when assigning Azure Service Bus Data Sender: Send access lets the principal inject messages into every queue or topic in the assigned scope, affecting downstream processing and cost.; and The role cannot receive messages or fully administer Service Bus resources.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Authenticate and authorize an application with Microsoft Entra ID to access Azure Service Bus entities →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.