Azure Integration built-in role
Azure Service Bus Data Sender
Reads Service Bus queue, topic, and subscription metadata through control-plane Actions and sends messages through a data-plane DataAction. It does not grant receive access or the complete administration and data access of Data Owner.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 69a216fc-b8fb-44d8-bc22-1f3c2cd27a39
Control-plane actions (3)
Microsoft.ServiceBus/*/queues/readMicrosoft.ServiceBus/*/topics/readMicrosoft.ServiceBus/*/topics/subscriptions/read
Data-plane actions (1)
Microsoft.ServiceBus/*/send/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign at the queue or topic that receives the producer's messages, at a namespace for all contained entities, or at resource-group or subscription scope for broader inherited access.
Common use cases (2)
- Authorize a producer application to send messages to one queue.
- Authorize a publisher application to send messages to one topic without receive or administration authority.
Prerequisites (2)
- The target queue or topic must exist and the producer must authenticate with Microsoft Entra ID for Service Bus.
- Identify the individual entity or namespace the producer is allowed to use before assigning the role.
Best practices (2)
- Assign directly on the queue or topic and use a managed identity for an Azure-hosted producer.
- Disable local or SAS authentication when compatible and use Data Owner only when the producer also requires receive or administration access.
Security considerations (2)
- Send access lets the principal inject messages into every queue or topic in the assigned scope, affecting downstream processing and cost.
- The role cannot receive messages or fully administer Service Bus resources.
Assignment guidance
Assign Azure Service Bus Data Sender to the producer identity on the individual queue or topic whenever possible. Broaden to namespace scope only when the same producer must send to multiple entities.
Related roles (2)
- Azure Service Bus Data Receiver: Provides the separate consumer path for receiving messages.
- Azure Service Bus Data Owner: Adds complete Service Bus management, send, and receive access.
Editorial sources (6)
- Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Authenticate and authorize an application with Microsoft Entra ID to access Azure Service Bus entities →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.