Azure Storage built-in role
Storage Queue Data Message Processor
Peeks, retrieves, and deletes messages from an Azure Storage queue. It has message DataActions only: it cannot add messages, create or delete queues, or modify queue metadata.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 8a0f0c08-91a1-4084-bc3d-661d67233fed
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (2)
Microsoft.Storage/storageAccounts/queueServices/queues/messages/readMicrosoft.Storage/storageAccounts/queueServices/queues/messages/process/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign the role at an individual queue whenever possible. The message read and process DataActions then apply only to messages in that queue; a storage-account or parent assignment is inherited by every queue beneath it.
Common use cases (2)
- Run a queue consumer that receives work messages and deletes them after successful processing.
- Let a troubleshooting worker peek or retrieve messages without granting message production or queue management.
Prerequisites (3)
- Create the queue separately and identify the managed identity or service principal that runs the consumer.
- Design message retry, invisibility, poison-message, and delete behavior before granting processing access.
- The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the queue scope.
Best practices (3)
- Assign to the consumer managed identity on one queue.
- Keep producers on Message Sender and use a separate dead-letter or poison-message workflow where the application requires one.
- Monitor processing failures because delete permission can permanently remove messages.
Security considerations (3)
- The consumer can read message payloads and delete messages after retrieval.
- Malformed or compromised consumer logic can lose work by deleting messages prematurely.
- The role cannot send messages or manage queue resources, which keeps producer and queue-administration duties separate.
Assignment guidance
Assign Storage Queue Data Message Processor to the consumer identity directly on its queue. Grant Message Sender to producers separately, and use Queue Data Contributor only when the same identity must also manage queue resources or send messages.
Related roles (2)
- Storage Queue Data Message Sender: Complementary producer role limited to adding messages.
- Storage Queue Data Contributor: Adds queue management and the complete message operation set.
Editorial sources (5)
- Azure built-in roles for Storage →
Supports: Description, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope. Retrieved 2026-07-16.
- Authorize access to queues using Microsoft Entra ID →
Supports: Description, Practical scope, Common use cases, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Assign an Azure role for access to queue data →
Supports: Practical scope, Prerequisites, Best practices, Assignment guidance. Retrieved 2026-07-16.