Azure-docs: What are the permissions needed to be able to Test Send?

[jstawski]

Can you please elaborate on the permissions needed for a user to be able to use the Test Send feature of the portal? We currently have a user that has that option disabled. He currently is a member of the Reader role for that Resource Group

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 4f45da7e-b566-ce6e-f2d3-3e929a87172d
• Version Independent ID: 7587047c-cafa-8293-e3d5-1ad3f56bf722
• Content: Diagnose dropped notifications in Azure Notification Hubs
• Content Source: articles/notification-hubs/notification-hubs-push-notification-fixer.md
• Service: notification-hubs
• GitHub Login: @sethmanheim
• Microsoft Alias: sethm

[BryanTrach-MSFT]

@jstawski Thanks for the feedback! We are currently investigating and will update you shortly.

[seangriffin2]

Thanks for looking into this @BryanTrach-MSFT! Any updates...?

[seangriffin2]

@BryanTrach-MSFT - Did you guys uncover anything? Thanks for checking into this!

[BryanTrach-MSFT]

@jstawski @seangriffin2 I apologize for the delay.

Sending a test notification goes beyond simply reading so the reader role will not work. Since sending test notifications has the ability to reach a wide array of customers, you can only use the default RBAC role of contributor. I assume this is too much access for your use case.

The good news is you can create a custom RBAC role to allow the user only the ability to send test notifications. To do this:

1. Navigate to the portal
2. Navigate to All Services> Subscriptions> Your subscription> Access Control (IAM)
3. Select the 'Add' button and then select 'Add custom role'
4. Give it a name, description, and start from scratch for baseline permissions
5. Then select the Permissions tab> Add permissions
6. Search for Notification
7. Select Microsoft Azure Notification Hub
8. Under 'Microsoft.NotificationHubs/Namespaces/NotificationHubs' select 'Other : Send a test push notification.' and then select 'Add'
9. Edit the scope as necessary

Keep in mind the user will still need the reader role to see the resource as well.

I hope this helps you. If not, please tag me in your reply and we can continue the discussion.

[jstawski]

Thank you @BryanTrach-MSFT I didn't know we could create custom roles!