Skip to content

Use identity-based authentication for Service Bus namespaces#

Security · Service Bus · Rule · 2022_03 · Important

Authenticate Service Bus publishers and consumers with Entra ID identities.

Description#

To publish or consume messages from Service Bus cryptographic keys, or Entra ID identities can be used. Cryptographic keys include Shared Access Policy keys or Shared Access Signature (SAS) tokens. With Entra ID authentication, the identity is validated against Entra ID. Using Entra ID identities centralizes identity management and auditing.

Once you decide to use Entra ID authentication, you can disable authentication using keys or SAS tokens.

Recommendation#

Consider only using Entra ID identities to publish or consume messages from Service Bus. Then disable authentication based on access keys or SAS tokens.

Examples#

Configure with Azure template#

To deploy namespaces that pass this rule:

  • Set the properties.disableLocalAuth property to true.

For example:

Azure Template snippet
{
  "type": "Microsoft.ServiceBus/namespaces",
  "apiVersion": "2022-10-01-preview",
  "name": "[parameters('name')]",
  "location": "[parameters('location')]",
  "identity": {
    "type": "SystemAssigned"
  },
  "sku": {
    "name": "Standard"
  },
  "properties": {
    "disableLocalAuth": true,
    "minimumTlsVersion": "1.2"
  }
}

Configure with Bicep#

To deploy namespaces that pass this rule:

  • Set the properties.disableLocalAuth property to true.

For example:

Azure Bicep snippet
resource ns 'Microsoft.ServiceBus/namespaces@2022-10-01-preview' = {
  name: name
  location: location
  identity: {
    type: 'SystemAssigned'
  }
  sku: {
    name: 'Standard'
  }
  properties: {
    disableLocalAuth: true
    minimumTlsVersion: '1.2'
  }
}

Configure with Azure Verified Modules

A pre-validated module supported by Microsoft is available from the Azure Bicep public registry. To reference the module, please use the following syntax:

br/public:avm/res/service-bus/namespace:<version>

To use the latest version:

br/public:avm/res/service-bus/namespace:0.9.1

Configure with Azure Policy#

To address this issue at runtime use the following policies:

Comments