Connect Azure Service Bus to DeadLetterOps

5 minutes Updated November 27, 2025

This 5-minute guide walks you through connecting your Azure Service Bus message broker to DeadLetterOps for dead letter queue (DLQ) monitoring. You'll need access to the Azure Portal with at least Contributor permissions.

Before You Begin

Make sure you have:

  • An Azure account with access to your Service Bus namespace

  • Contributor or Owner role on the Service Bus resource

  • A DeadLetterOps account (sign up free)

1

Open the Azure Portal

Navigate to portal.azure.com and sign in with your Azure account.

2

Find your Service Bus namespace

In the Azure Portal, search for "Service Bus" in the top search bar, or navigate to All services > Integration > Service Bus. Select the namespace you want to monitor.

3

Go to Shared access policies

In the left sidebar of your Service Bus namespace, under Settings, click on Shared access policies.

4

Select or create a policy with Manage permissions

You can use the default RootManageSharedAccessKey policy, or create a new one. If creating a new policy, ensure it has the Manage permission checked.

For production environments, we recommend creating a dedicated policy named something like "DeadLetterOps" rather than using the root key. This makes it easier to rotate credentials and audit access.

5

Copy the connection string

Click on your chosen policy to open its details. You'll see two connection strings:

  • Primary Connection String

  • Secondary Connection String

Click the copy button next to either connection string (they're interchangeable).

Connection String Format 
Endpoint=sb://your-namespace.servicebus.windows.net/;SharedAccessKeyName=RootManageSharedAccessKey;SharedAccessKey=your-key-here
6

Add to DeadLetterOps

Open DeadLetterOps and navigate to Message Brokers > Add Broker. Select Azure Service Bus as the broker type, paste your connection string, and give it a friendly name (e.g., "Production Service Bus").

Verify Your Connection

After adding your connection string, confirm the setup is working:

  1. Connection status shows "Connected" - The broker card should display a green status indicator within 30 seconds.

  2. Queues and topics appear - Click on your broker to see discovered queues and topics. This may take up to 60 seconds for large namespaces.

  3. Dead letter counts display - If any queues have dead letter messages, you'll see the count on each queue card.

If any of these checks fail, see the Troubleshooting section below.

Troubleshooting

Connection Failed: Invalid Connection String

If DeadLetterOps shows "Connection failed" or "Invalid credentials":

  • Copied an incomplete string - The connection string must start with Endpoint=sb:// and include both SharedAccessKeyName and SharedAccessKey. Copy the entire connection string value.

  • Policy lacks Manage permission - DeadLetterOps requires the Manage claim to read dead letter queues. Check your policy has all three permissions: Listen, Send, and Manage.

  • Private endpoints not supported - DeadLetterOps currently requires your Service Bus namespace to be publicly accessible. Private endpoints and IP filtering are not yet supported.

No Queues or Topics Discovered

If connection succeeds but no queues or topics appear:

  • Empty namespace - Your Service Bus namespace has no queues or topics yet. Create at least one in Azure, then refresh in DeadLetterOps.

  • Discovery still running - Initial discovery can take up to 60 seconds. Wait and refresh the page.

  • Using a queue-specific connection string - If you copied a connection string from a specific queue (not the namespace), DeadLetterOps can only see that queue. Use the namespace-level connection string.

Permission Denied in Azure Portal

If you cannot view Shared Access Policies or create new policies, you need at least Contributor role on the Service Bus namespace. Contact your Azure administrator to request access.