Connection Strings & Authentication in Azure Service Bus

Overview

Learn how to authenticate with Azure Service Bus using connection strings and SAS policies.

Finding Your Connection String

Via Portal

1. Go to Service Bus Namespace
2. Navigate to Settings → Shared access policies
3. Click on a policy (or create new)
4. Copy the Connection string or Primary Key

Default Policy

• Name: RootManageSharedAccessKey
• Permissions: Manage, Send, Listen
• Warning: Don't use in production!

Connection String Format

Endpoint=sb://yournamespace.servicebus.windows.net/;SharedAccessKeyName=policy-name;SharedAccessKey=your-key

Create Custom SAS Policy

Via Portal

1. Go to Service Bus Namespace
2. Navigate to Settings → Shared access policies
3. Click + Add
4. Configure:
   • Name: sender-policy
   • Permissions: Select Send, Listen (not Manage)
5. Click Create
6. Copy the connection string

Via CLI

az servicebus namespace authorization-rule create \
  --resource-group myrg \
  --namespace-name mynamespace \
  --name sender-policy \
  --rights Send Listen

Authentication in Code

Using Connection String

string connectionString = "Endpoint=sb://mynamespace.servicebus.windows.net/;SharedAccessKeyName=sender-policy;SharedAccessKey=...";

await using var client = new ServiceBusClient(connectionString);
await using var sender = client.CreateSender("my-queue");

Security Best Practices

Managed Identity (Recommended for Production)

// No connection string needed!
var client = new ServiceBusClient(
    new Uri("https://mynamespace.servicebus.windows.net"),
    new DefaultAzureCredential()
);

Enable Managed Identity

1. Go to Service Bus Namespace
2. Navigate to Identity
3. Turn on System assigned or User assigned
4. Grant "Azure Service Bus Data Owner" role in IAM

Permissions Explained

Next Steps

• Explore Azure Functions - What Is Serverless?

Azure Integration Hub - Beginner Level