Azure Storage built-in role

Storage Queue Data Message Processor

Peeks, retrieves, and deletes messages from an Azure Storage queue. It has message DataActions only: it cannot add messages, create or delete queues, or modify queue metadata.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: 8a0f0c08-91a1-4084-bc3d-661d67233fed

Control-plane actions (0)

None — this role grants no control-plane management actions.

Data-plane actions (2)

Microsoft.Storage/storageAccounts/queueServices/queues/messages/read
Microsoft.Storage/storageAccounts/queueServices/queues/messages/process/action

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

Assign the role at an individual queue whenever possible. The message read and process DataActions then apply only to messages in that queue; a storage-account or parent assignment is inherited by every queue beneath it.

Common use cases (2)

Run a queue consumer that receives work messages and deletes them after successful processing.
Let a troubleshooting worker peek or retrieve messages without granting message production or queue management.

Prerequisites (3)

Create the queue separately and identify the managed identity or service principal that runs the consumer.
Design message retry, invisibility, poison-message, and delete behavior before granting processing access.
The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the queue scope.

Best practices (3)

Assign to the consumer managed identity on one queue.
Keep producers on Message Sender and use a separate dead-letter or poison-message workflow where the application requires one.
Monitor processing failures because delete permission can permanently remove messages.

Security considerations (3)

The consumer can read message payloads and delete messages after retrieval.
Malformed or compromised consumer logic can lose work by deleting messages prematurely.
The role cannot send messages or manage queue resources, which keeps producer and queue-administration duties separate.

Assignment guidance

Assign Storage Queue Data Message Processor to the consumer identity directly on its queue. Grant Message Sender to producers separately, and use Queue Data Contributor only when the same identity must also manage queue resources or send messages.

Related roles (2)

Storage Queue Data Message Sender: Complementary producer role limited to adding messages.
Storage Queue Data Contributor: Adds queue management and the complete message operation set.

Common questions

When should I assign the Storage Queue Data Message Processor Azure role?

Assign Storage Queue Data Message Processor when you need to: Run a queue consumer that receives work messages and deletes them after successful processing.; and Let a troubleshooting worker peek or retrieve messages without granting message production or queue management.. Practical scope: Assign the role at an individual queue whenever possible. The message read and process DataActions then apply only to messages in that queue; a storage-account or parent assignment is inherited by every queue beneath it.

What permissions does the Storage Queue Data Message Processor Azure role grant?

The role definition grants 2 combined control-plane and data-plane actions. Representative operations include: Microsoft.Storage/storageAccounts/queueServices/queues/messages/read; and Microsoft.Storage/storageAccounts/queueServices/queues/messages/process/action. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Storage Queue Data Message Processor Azure role?

Key considerations when assigning Storage Queue Data Message Processor: The consumer can read message payloads and delete messages after retrieval.; Malformed or compromised consumer logic can lose work by deleting messages prematurely.; and The role cannot send messages or manage queue resources, which keeps producer and queue-administration duties separate.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (5)

Azure built-in roles for Storage →
Supports: Description, Security considerations. Retrieved 2026-07-16.
Steps to assign an Azure role →
Supports: Prerequisites. Retrieved 2026-07-16.
Understand scope for Azure RBAC →
Supports: Practical scope. Retrieved 2026-07-16.
Authorize access to queues using Microsoft Entra ID →
Supports: Description, Practical scope, Common use cases, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
Assign an Azure role for access to queue data →
Supports: Practical scope, Prerequisites, Best practices, Assignment guidance. Retrieved 2026-07-16.

Official Microsoft Learn documentation →