Managed Entity Queue-Scoped Permissions for Endpoints

It is common practice to limit Azure Service Bus connection permissions at the queue scope when using Managed Entities.

The following shows the minimum permissions needed for various endpoint features using queue-scoped permissions:

• Azure Service Bus Data Receiver to the endpoint's queue is required to process messages.

• Azure Service Bus Data Sender to the endpoint's queue is required for:

  • Delayed retries
  • Saga Timeouts
  • Transactional Session
  • .SendLocal()

• Azure Service Bus Data Sender is required for the error queue.

• Azure Service Bus Data Sender is required for every queue the endpoint sends a command to.

• Azure Service Bus Data Sender is required for every queue the endpoint replies to.

• Azure Service Bus Data Sender is required for every topic the endpoint publishes an event to.

• Microsoft.ServiceBus/namespaces/topics/subscriptions/write is required for every topic the endpoint handles events from when using automatic subscriptions (default).

• Azure Service Bus Data Sender is required for the audit queue when auditing is enabled.

• Azure Service Bus Data Sender is required for the transactional session remote processor queue, when configured.

• Azure Service Bus Data Sender is required for the metrics queue when ServiceControl metrics are enabled.

• Azure Service Bus Data Sender is required for the ServiceControl queue when heartbeats or custom checks are being used.

• Azure Service Bus Data Sender is required for any queue the endpoint forwards to.

• Azure Service Bus Data Receiver is required for every satellite queue created.

Access rights

By default, the transport requires elevated privileges to manage namespace entities at runtime. If using a shared access policy, make sure to include Manage rights or the Azure Service Bus Data Owner role if authenticating using Managed Identities.

To avoid running with elevated privileges:

• Make sure that installers are not configured to run

• Use operational scripting to provision entities (queues, topics, and subscriptions)

• Turn off automatic subscriptions

Subscribing without Manage rights

Subscribing to an event creates a subscription on each topic the event is mapped to. Creating a subscription requires Manage rights, even when the subscription already exists. Without them, the subscribe operation fails and the transport logs an error. With automatic subscriptions, the endpoint still starts; an explicit subscribe call throws instead. What the endpoint receives depends on what was provisioned:

• If the subscription exists, events continue to arrive through it.
• With filtered routing in version 6.4 and later, the filter rule for each event must also exist. The transport doesn't add rules when creating the subscription fails.
• If the subscription or rule is missing, the endpoint doesn't receive the events that depend on it. Events published before it's created are never delivered to the endpoint.

Unsubscribing without Manage rights

With filtered routing in version 6.4 and later, unsubscribing from an event deletes only the event's filter rule, which doesn't require Manage rights.

Otherwise, unsubscribing deletes the subscription. Without Manage rights, the transport leaves the subscription in place and logs the failure at Info level:

• Events published to that topic continue to arrive in the endpoint's input queue and are processed as before.
• If the endpoint is stopped or decommissioned, these events accumulate in its input queue.

To stop the events, remove the subscription using operational scripting.