# Managed Entity Queue-Scoped Permissions for Endpoints

<!-- Version variant: asbs_5; default: [/transports/azure-service-bus/queue-scoped-permissions.md](/transports/azure-service-bus/queue-scoped-permissions.md) -->


It is common practice to limit [Azure Service Bus connection permissions at the queue scope when using Managed Entities](https://learn.microsoft.com/en-us/azure/service-bus-messaging/service-bus-managed-service-identity#resource-scope). 

The following shows the minimum permissions needed for various endpoint features using queue-scoped permissions:

- `Azure Service Bus Data Receiver` to the endpoint's queue is required to process messages.
- `Azure Service Bus Data Sender` to the endpoint's queue is required for:
  - [Delayed retries](/nservicebus/recoverability/index.md#delayed-retries)
  - [Saga Timeouts](/nservicebus/sagas/timeouts.md)
  - [Transactional Session](/nservicebus/transactional-session/index.md)
  - [`.SendLocal()`](/nservicebus/messaging/send-a-message.md#sending-to-self)
- `Azure Service Bus Data Sender` is required for the [error queue](/nservicebus/recoverability/configure-error-handling.md#configure-the-error-queue-address-using-code).
- `Azure Service Bus Data Sender` is required for every [queue the endpoint sends a command to](/nservicebus/messaging/routing.md#command-routing).
- `Azure Service Bus Data Sender` is required for every [queue the endpoint replies to](/nservicebus/messaging/reply-to-a-message.md).
- `Azure Service Bus Data Sender` is required for every [topic the endpoint publishes an event to](/transports/azure-service-bus/topology.md).

- `Azure Service Bus Data Sender` is required for the audit queue when [auditing](/nservicebus/operations/auditing.md#configuring-auditing) is enabled.
- `Azure Service Bus Data Sender` is required for the [transactional session remote processor](/nservicebus/transactional-session/index.md#remote-processor) queue, when configured.
- `Azure Service Bus Data Sender` is required for the metrics queue when ServiceControl [metrics](/monitoring/metrics/install-plugin.md#configuration) are enabled.
- `Azure Service Bus Data Sender` is required for the ServiceControl queue when [heartbeats](/monitoring/heartbeats/install-plugin.md) or [custom checks](/monitoring/custom-checks/install-plugin.md) are being used.
- `Azure Service Bus Data Sender` is required for any queue the endpoint [forwards to](/nservicebus/messaging/forwarding.md).
- `Azure Service Bus Data Receiver` is required for every [satellite queue](/nservicebus/satellites/index.md) created.


### Access rights

By default, the transport requires elevated privileges to manage namespace entities at runtime. If using a [shared access policy](https://learn.microsoft.com/en-us/azure/service-bus-messaging/service-bus-sas), make sure to include `Manage` rights or the [Azure Service Bus Data Owner](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#azure-service-bus-data-owner) role if authenticating using [Managed Identities](https://learn.microsoft.com/en-us/azure/service-bus-messaging/service-bus-managed-service-identity).

To avoid running with elevated privileges:

- Make sure that [installers are not configured to run](/nservicebus/operations/installers.md)
- Use [operational scripting](/transports/azure-service-bus/operational-scripting.md) to provision entities(queues, topics and subscriptions)