Azure Storage built-in role
Storage Queue Data Message Sender
Adds messages to an Azure Storage queue. It has one message DataAction and cannot read, process, or delete messages or create, delete, or configure queues.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: c6a89b2d-59bc-44d0-9896-0f6e12d7b80a
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (1)
Microsoft.Storage/storageAccounts/queueServices/queues/messages/add/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign the role at an individual queue whenever possible. Its add-message permission then applies only to that queue; a storage-account or parent assignment is inherited by every queue beneath it.
Common use cases (2)
- Run an application component that publishes work or event messages to one queue.
- Separate message production from consumption and queue administration.
Prerequisites (3)
- Create the queue separately and identify the managed identity or service principal that publishes messages.
- Define message size, schema, validation, and rate controls in the application.
- The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the queue scope.
Best practices (3)
- Assign to the producer managed identity on one queue.
- Keep consumers on Message Processor and queue owners on Queue Data Contributor.
- Validate and constrain message content in the producer because Azure RBAC does not validate application payloads.
Security considerations (3)
- The role can inject messages that trigger downstream work, cost, or state changes.
- It cannot inspect existing messages, consume them, or change the queue.
- A broad parent assignment lets the producer inject messages into every inheriting queue.
Assignment guidance
Assign Storage Queue Data Message Sender to the producer identity directly on the target queue. Keep processor and queue-management permissions on separate identities unless the application architecture explicitly requires combining them.
Related roles (2)
- Storage Queue Data Message Processor: Complementary consumer role for peeking, retrieving, and deleting messages.
- Storage Queue Data Contributor: Adds queue management and all message operations.
Common questions
When should I assign the Storage Queue Data Message Sender Azure role?
Assign Storage Queue Data Message Sender when you need to: Run an application component that publishes work or event messages to one queue.; and Separate message production from consumption and queue administration.. Practical scope: Assign the role at an individual queue whenever possible. Its add-message permission then applies only to that queue; a storage-account or parent assignment is inherited by every queue beneath it.
What permissions does the Storage Queue Data Message Sender Azure role grant?
The role definition grants 1 combined control-plane and data-plane actions. Representative operations include: Microsoft.Storage/storageAccounts/queueServices/queues/messages/add/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Storage Queue Data Message Sender Azure role?
Key considerations when assigning Storage Queue Data Message Sender: The role can inject messages that trigger downstream work, cost, or state changes.; It cannot inspect existing messages, consume them, or change the queue.; and A broad parent assignment lets the producer inject messages into every inheriting queue.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for Storage →
Supports: Description, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope. Retrieved 2026-07-16.
- Authorize access to queues using Microsoft Entra ID →
Supports: Description, Practical scope, Common use cases, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Assign an Azure role for access to queue data →
Supports: Practical scope, Prerequisites, Best practices, Assignment guidance. Retrieved 2026-07-16.