Azure Storage built-in role
Storage Queue Data Contributor
Reads, creates, updates, and deletes Azure Storage queues and can add, read, process, and delete queue messages with Microsoft Entra authorization. It directly grants Queue Storage data access without granting storage-account keys or general storage-account management.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 974c5e8b-45b9-4653-ba55-5f855dd0fb88
Control-plane actions (3)
Microsoft.Storage/storageAccounts/queueServices/queues/deleteMicrosoft.Storage/storageAccounts/queueServices/queues/readMicrosoft.Storage/storageAccounts/queueServices/queues/write
Data-plane actions (4)
Microsoft.Storage/storageAccounts/queueServices/queues/messages/deleteMicrosoft.Storage/storageAccounts/queueServices/queues/messages/readMicrosoft.Storage/storageAccounts/queueServices/queues/messages/writeMicrosoft.Storage/storageAccounts/queueServices/queues/messages/process/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
The role can be assigned at an individual queue, storage account, resource group, subscription, or management group and is inherited by child messages. Queue scope confines queue and message operations to that queue; broader scopes cover every inheriting queue.
Common use cases (2)
- Run an application or operator workflow that must manage a queue and send, receive, process, and delete its messages.
- Administer queue properties and message lifecycle without granting storage-account management or Shared Key access.
Prerequisites (3)
- Identify the user, group, service principal, or managed identity and the individual queues it must manage.
- For portal navigation using Microsoft Entra credentials, also grant Reader at the storage-account scope.
- The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target queue or parent scope.
Best practices (3)
- Assign to a managed identity and directly on the target queue whenever possible.
- Use Message Sender or Message Processor when the workload only produces or consumes messages, and Queue Data Reader for read-only inspection.
- Prefer Microsoft Entra authorization and avoid roles with listKeys that would bypass the queue-scoped boundary through Shared Key.
Security considerations (3)
- The role can read, add, process, and delete messages and create, update, or delete queues in scope.
- Processing or deleting messages can change application state or cause data loss.
- A storage-account or parent assignment reaches every queue and message beneath it.
Assignment guidance
Assign Storage Queue Data Contributor to the workload identity on the individual queue only when it needs both queue management and complete message operations. Choose Sender, Processor, or Reader for operation-specific workloads and add Reader separately only for portal navigation.
Related roles (3)
- Storage Queue Data Message Sender: Message-production role limited to adding messages.
- Storage Queue Data Message Processor: Message-consumer role limited to peeking, retrieving, and deleting messages.
- Storage Queue Data Reader: Read-only queue and message alternative.
Common questions
When should I assign the Storage Queue Data Contributor Azure role?
Assign Storage Queue Data Contributor when you need to: Run an application or operator workflow that must manage a queue and send, receive, process, and delete its messages.; and Administer queue properties and message lifecycle without granting storage-account management or Shared Key access.. Practical scope: The role can be assigned at an individual queue, storage account, resource group, subscription, or management group and is inherited by child messages. Queue scope confines queue and message operations to that queue; broader scopes cover every inheriting queue.
What permissions does the Storage Queue Data Contributor Azure role grant?
The role definition grants 7 combined control-plane and data-plane actions. Representative operations include: Microsoft.Storage/storageAccounts/queueServices/queues/delete; Microsoft.Storage/storageAccounts/queueServices/queues/read; Microsoft.Storage/storageAccounts/queueServices/queues/write; Microsoft.Storage/storageAccounts/queueServices/queues/messages/delete; Microsoft.Storage/storageAccounts/queueServices/queues/messages/read; and Microsoft.Storage/storageAccounts/queueServices/queues/messages/write. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Storage Queue Data Contributor Azure role?
Key considerations when assigning Storage Queue Data Contributor: The role can read, add, process, and delete messages and create, update, or delete queues in scope.; Processing or deleting messages can change application state or cause data loss.; and A storage-account or parent assignment reaches every queue and message beneath it.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Storage →
Supports: Description, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Security considerations. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-16.
- Authorize access to queues using Microsoft Entra ID →
Supports: Description, Practical scope, Common use cases, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Assign an Azure role for access to queue data →
Supports: Practical scope, Prerequisites, Best practices, Assignment guidance. Retrieved 2026-07-16.