Azure Storage built-in role

Storage Queue Delegator

Requests a Queue service user delegation key that can sign a user delegation SAS for an Azure Storage queue. The key cannot access queue data directly and the role has no DataActions; separate queue data permissions bound the SAS operations.

Control-plane actions (1)

• Microsoft.Storage/storageAccounts/queueServices/generateUserDelegationKey/action

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The delegation-key action operates at storage-account level, so assign this role on the storage account, resource group, or subscription. Keep the broker's separate queue data role scoped to the intended queue so key generation does not automatically grant account-wide message access.

Common use cases (2)

• Let a trusted SAS broker issue short-lived user delegation SAS tokens for approved queue clients.
• Keep direct message permissions queue-scoped while granting the broker account-level delegation-key authority.

Prerequisites (3)

• Use a storage service version that supports Queue user delegation SAS and grant the broker a separate queue data role that defines its maximum delegated operations.
• Design the SAS queue, permissions, expiry, HTTPS requirement, distribution, logging, and revocation process.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at storage-account scope or higher.

Best practices (3)

• Assign to a dedicated SAS-broker managed identity at one storage account.
• Issue the minimum queue permissions for the shortest practical period and require HTTPS.
• Log SAS issuance in the broker and maintain a tested revocation path because Azure Storage does not inventory generated SAS tokens.

Security considerations (3)

• A delegation key can sign multiple bearer SAS tokens during its lifetime.
• The role alone cannot read or mutate queues, but combined queue data roles determine the maximum permissions the broker can delegate.
• A leaked queue SAS can expose or alter message flow until it expires or is revoked.

Assignment guidance

Assign Storage Queue Delegator to a trusted SAS-broker identity on the storage account, with a separate queue data role constrained to the intended queue. Generate short-lived HTTPS-only tokens, record issuance, and test revocation.

Related roles (2)

• Storage Queue Data Reader: A separate role that can bound delegated queue access to reads.
• Storage Queue Data Contributor: A separate role that can bound delegated access to queue and message mutation.

Editorial sources (5)

• Azure built-in roles for Storage →

  Supports: Description. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope. Retrieved 2026-07-16.

• Grant limited access to data with shared access signatures →

  Supports: Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• Create a user delegation SAS →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →