Azure Storage built-in role

Storage Queue Data Contributor

Reads, creates, updates, and deletes Azure Storage queues and can add, read, process, and delete queue messages with Microsoft Entra authorization. It directly grants Queue Storage data access without granting storage-account keys or general storage-account management.

Control-plane actions (3)

• Microsoft.Storage/storageAccounts/queueServices/queues/delete
• Microsoft.Storage/storageAccounts/queueServices/queues/read
• Microsoft.Storage/storageAccounts/queueServices/queues/write

Data-plane actions (4)

• Microsoft.Storage/storageAccounts/queueServices/queues/messages/delete
• Microsoft.Storage/storageAccounts/queueServices/queues/messages/read
• Microsoft.Storage/storageAccounts/queueServices/queues/messages/write
• Microsoft.Storage/storageAccounts/queueServices/queues/messages/process/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The role can be assigned at an individual queue, storage account, resource group, subscription, or management group and is inherited by child messages. Queue scope confines queue and message operations to that queue; broader scopes cover every inheriting queue.

Common use cases (2)

• Run an application or operator workflow that must manage a queue and send, receive, process, and delete its messages.
• Administer queue properties and message lifecycle without granting storage-account management or Shared Key access.

Prerequisites (3)

• Identify the user, group, service principal, or managed identity and the individual queues it must manage.
• For portal navigation using Microsoft Entra credentials, also grant Reader at the storage-account scope.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target queue or parent scope.

Best practices (3)

• Assign to a managed identity and directly on the target queue whenever possible.
• Use Message Sender or Message Processor when the workload only produces or consumes messages, and Queue Data Reader for read-only inspection.
• Prefer Microsoft Entra authorization and avoid roles with listKeys that would bypass the queue-scoped boundary through Shared Key.

Security considerations (3)

• The role can read, add, process, and delete messages and create, update, or delete queues in scope.
• Processing or deleting messages can change application state or cause data loss.
• A storage-account or parent assignment reaches every queue and message beneath it.

Assignment guidance

Assign Storage Queue Data Contributor to the workload identity on the individual queue only when it needs both queue management and complete message operations. Choose Sender, Processor, or Reader for operation-specific workloads and add Reader separately only for portal navigation.

Related roles (3)

• Storage Queue Data Message Sender: Message-production role limited to adding messages.
• Storage Queue Data Message Processor: Message-consumer role limited to peeking, retrieving, and deleting messages.
• Storage Queue Data Reader: Read-only queue and message alternative.

Editorial sources (6)

• Azure built-in roles for Storage →

  Supports: Description, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Security considerations. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Authorize access to queues using Microsoft Entra ID →

  Supports: Description, Practical scope, Common use cases, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Assign an Azure role for access to queue data →

  Supports: Practical scope, Prerequisites, Best practices, Assignment guidance. Retrieved 2026-07-16.

Official Microsoft Learn documentation →