Azure Storage built-in role
Storage Queue Delegator
Requests a Queue service user delegation key that can sign a user delegation SAS for an Azure Storage queue. The key cannot access queue data directly and the role has no DataActions; separate queue data permissions bound the SAS operations.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 7ee386e9-84f0-448e-80a6-f185f6533131
Control-plane actions (1)
Microsoft.Storage/storageAccounts/queueServices/generateUserDelegationKey/action
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
The delegation-key action operates at storage-account level, so assign this role on the storage account, resource group, or subscription. Keep the broker's separate queue data role scoped to the intended queue so key generation does not automatically grant account-wide message access.
Common use cases (2)
- Let a trusted SAS broker issue short-lived user delegation SAS tokens for approved queue clients.
- Keep direct message permissions queue-scoped while granting the broker account-level delegation-key authority.
Prerequisites (3)
- Use a storage service version that supports Queue user delegation SAS and grant the broker a separate queue data role that defines its maximum delegated operations.
- Design the SAS queue, permissions, expiry, HTTPS requirement, distribution, logging, and revocation process.
- The assigning administrator needs Microsoft.Authorization/roleAssignments/write at storage-account scope or higher.
Best practices (3)
- Assign to a dedicated SAS-broker managed identity at one storage account.
- Issue the minimum queue permissions for the shortest practical period and require HTTPS.
- Log SAS issuance in the broker and maintain a tested revocation path because Azure Storage does not inventory generated SAS tokens.
Security considerations (3)
- A delegation key can sign multiple bearer SAS tokens during its lifetime.
- The role alone cannot read or mutate queues, but combined queue data roles determine the maximum permissions the broker can delegate.
- A leaked queue SAS can expose or alter message flow until it expires or is revoked.
Assignment guidance
Assign Storage Queue Delegator to a trusted SAS-broker identity on the storage account, with a separate queue data role constrained to the intended queue. Generate short-lived HTTPS-only tokens, record issuance, and test revocation.
Related roles (2)
- Storage Queue Data Reader: A separate role that can bound delegated queue access to reads.
- Storage Queue Data Contributor: A separate role that can bound delegated access to queue and message mutation.
Common questions
When should I assign the Storage Queue Delegator Azure role?
Assign Storage Queue Delegator when you need to: Let a trusted SAS broker issue short-lived user delegation SAS tokens for approved queue clients.; and Keep direct message permissions queue-scoped while granting the broker account-level delegation-key authority.. Practical scope: The delegation-key action operates at storage-account level, so assign this role on the storage account, resource group, or subscription. Keep the broker's separate queue data role scoped to the intended queue so key generation does not automatically grant account-wide message access.
What permissions does the Storage Queue Delegator Azure role grant?
The role definition grants 1 combined control-plane and data-plane actions. Representative operations include: Microsoft.Storage/storageAccounts/queueServices/generateUserDelegationKey/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Storage Queue Delegator Azure role?
Key considerations when assigning Storage Queue Delegator: A delegation key can sign multiple bearer SAS tokens during its lifetime.; The role alone cannot read or mutate queues, but combined queue data roles determine the maximum permissions the broker can delegate.; and A leaked queue SAS can expose or alter message flow until it expires or is revoked.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for Storage →
Supports: Description. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope. Retrieved 2026-07-16.
- Grant limited access to data with shared access signatures →
Supports: Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.
- Create a user delegation SAS →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.