Azure Storage built-in role
Storage Queue Data Reader
Reads and lists Azure Storage queues and reads or peeks queue messages with Microsoft Entra authorization. It cannot add, process, or delete messages and cannot create, update, or delete queues.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 19e7f393-937e-4f77-808e-94535e297925
Control-plane actions (1)
Microsoft.Storage/storageAccounts/queueServices/queues/read
Data-plane actions (1)
Microsoft.Storage/storageAccounts/queueServices/queues/messages/read
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
The role can be assigned at an individual queue, storage account, resource group, subscription, or management group and is inherited by child messages. Queue scope confines reads to one queue; broader scopes expose every inheriting queue and message.
Common use cases (2)
- Inspect queue properties, metadata, and messages for monitoring or troubleshooting without changing them.
- Run a read-only application that queries queue state and message payloads.
Prerequisites (3)
- Identify the queue and principal that require message visibility.
- For portal navigation using Microsoft Entra credentials, also grant Reader at the storage-account scope.
- The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the queue scope.
Best practices (3)
- Assign directly on one queue and to a group or managed identity.
- Use Message Processor only when the workload must receive and delete messages, and Contributor only for queue management.
- Avoid listKeys-bearing roles that would allow Shared Key access beyond this read-only queue boundary.
Security considerations (3)
- Read access exposes queue metadata and message payloads, which can contain sensitive application data.
- The role cannot send, process, delete, or mutate queue data.
- A parent assignment exposes messages in every inheriting queue.
Assignment guidance
Assign Storage Queue Data Reader on the individual queue for view-only access. Add Reader separately only for portal navigation and escalate to Message Processor or Queue Data Contributor only for an approved operational need.
Related roles (2)
- Storage Queue Data Message Processor: Adds message retrieval and deletion for consumer workloads.
- Storage Queue Data Contributor: Adds queue management and full message mutation.
Common questions
When should I assign the Storage Queue Data Reader Azure role?
Assign Storage Queue Data Reader when you need to: Inspect queue properties, metadata, and messages for monitoring or troubleshooting without changing them.; and Run a read-only application that queries queue state and message payloads.. Practical scope: The role can be assigned at an individual queue, storage account, resource group, subscription, or management group and is inherited by child messages. Queue scope confines reads to one queue; broader scopes expose every inheriting queue and message.
What permissions does the Storage Queue Data Reader Azure role grant?
The role definition grants 2 combined control-plane and data-plane actions. Representative operations include: Microsoft.Storage/storageAccounts/queueServices/queues/read; and Microsoft.Storage/storageAccounts/queueServices/queues/messages/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Storage Queue Data Reader Azure role?
Key considerations when assigning Storage Queue Data Reader: Read access exposes queue metadata and message payloads, which can contain sensitive application data.; The role cannot send, process, delete, or mutate queue data.; and A parent assignment exposes messages in every inheriting queue.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for Storage →
Supports: Description, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope. Retrieved 2026-07-16.
- Authorize access to queues using Microsoft Entra ID →
Supports: Description, Practical scope, Common use cases, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Assign an Azure role for access to queue data →
Supports: Practical scope, Prerequisites, Best practices, Assignment guidance. Retrieved 2026-07-16.