Skip to content

Use identity-based authentication for Service Bus namespaces#

Security · Service Bus · Rule · 2022_03

Authenticate Service Bus publishers and consumers with Azure AD identities.

Description#

To publish or consume messages from Service Bus cryptographic keys, or Azure AD identities can be used. Cryptographic keys include Shared Access Policy keys or Shared Access Signature (SAS) tokens. With Azure AD authentication, the identity is validated against Azure AD. Using Azure AD identities centralizes identity management and auditing.

Once you decide to use Azure AD authentication, you can disable authentication using keys or SAS tokens.

Recommendation#

Consider only using Azure AD identities to publish or consume messages from Service Bus. Then disable authentication based on access keys or SAS tokens.

Examples#

Configure with Azure template#

To deploy Service Bus namespaces that pass this rule:

  • Set the properties.disableLocalAuth property to true.

For example:

Azure Template snippet
{
    "type": "Microsoft.ServiceBus/namespaces",
    "apiVersion": "2021-11-01",
    "name": "[parameters('name')]",
    "location": "[parameters('location')]",
    "identity": {
        "type": "SystemAssigned"
    },
    "sku": {
        "name": "Standard"
    },
    "properties": {
        "disableLocalAuth": true
    }
}

Configure with Bicep#

To deploy Service Bus namespaces that pass this rule:

  • Set the properties.disableLocalAuth property to true.

For example:

Azure Bicep snippet
resource ns 'Microsoft.ServiceBus/namespaces@2021-11-01' = {
  name: name
  location: location
  identity: {
    type: 'SystemAssigned'
  }
  sku: {
    name: 'Standard'
  }
  properties: {
    disableLocalAuth: true
  }
}
Last update: 2023-09-10

Comments