Azure Storage built-in role

Storage Queue Data Reader

Reads and lists Azure Storage queues and reads or peeks queue messages with Microsoft Entra authorization. It cannot add, process, or delete messages and cannot create, update, or delete queues.

Control-plane actions (1)

• Microsoft.Storage/storageAccounts/queueServices/queues/read

Data-plane actions (1)

• Microsoft.Storage/storageAccounts/queueServices/queues/messages/read

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The role can be assigned at an individual queue, storage account, resource group, subscription, or management group and is inherited by child messages. Queue scope confines reads to one queue; broader scopes expose every inheriting queue and message.

Common use cases (2)

• Inspect queue properties, metadata, and messages for monitoring or troubleshooting without changing them.
• Run a read-only application that queries queue state and message payloads.

Prerequisites (3)

• Identify the queue and principal that require message visibility.
• For portal navigation using Microsoft Entra credentials, also grant Reader at the storage-account scope.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the queue scope.

Best practices (3)

• Assign directly on one queue and to a group or managed identity.
• Use Message Processor only when the workload must receive and delete messages, and Contributor only for queue management.
• Avoid listKeys-bearing roles that would allow Shared Key access beyond this read-only queue boundary.

Security considerations (3)

• Read access exposes queue metadata and message payloads, which can contain sensitive application data.
• The role cannot send, process, delete, or mutate queue data.
• A parent assignment exposes messages in every inheriting queue.

Assignment guidance

Assign Storage Queue Data Reader on the individual queue for view-only access. Add Reader separately only for portal navigation and escalate to Message Processor or Queue Data Contributor only for an approved operational need.

Related roles (2)

• Storage Queue Data Message Processor: Adds message retrieval and deletion for consumer workloads.
• Storage Queue Data Contributor: Adds queue management and full message mutation.

Editorial sources (5)

• Azure built-in roles for Storage →

  Supports: Description, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope. Retrieved 2026-07-16.

• Authorize access to queues using Microsoft Entra ID →

  Supports: Description, Practical scope, Common use cases, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Assign an Azure role for access to queue data →

  Supports: Practical scope, Prerequisites, Best practices, Assignment guidance. Retrieved 2026-07-16.

Official Microsoft Learn documentation →