Azure Storage built-in role

Avere Contributor

Creates and manages the compute, network, deployment, storage, monitoring, and support resources used by an Avere vFXT cluster. The role also has direct read, write, and delete access to blob data for the cluster workflow; the Avere documentation is archived, but the built-in role remains in the canonical Azure role inventory.

Control-plane actions (20)

• Microsoft.Authorization/*/read
• Microsoft.Compute/*/read
• Microsoft.Compute/availabilitySets/*
• Microsoft.Compute/proximityPlacementGroups/*
• Microsoft.Compute/virtualMachines/*
• Microsoft.Compute/disks/*
• Microsoft.Network/*/read
• Microsoft.Network/networkInterfaces/*
• Microsoft.Network/virtualNetworks/read
• Microsoft.Network/virtualNetworks/subnets/read
• Microsoft.Network/virtualNetworks/subnets/join/action
• Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action
• Microsoft.Network/networkSecurityGroups/join/action
• Microsoft.Resources/deployments/*
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Storage/*/read
• Microsoft.Storage/storageAccounts/*
• Microsoft.Support/*
• Microsoft.Resources/subscriptions/resourceGroups/resources/read

Data-plane actions (3)

• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete
• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read
• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The role is assignable throughout the Azure hierarchy, but the Avere deployment guidance places the cluster controller, nodes, network, and storage in a deliberately isolated subscription or resource group. Its Actions are broad across those cluster resources and its DataActions reach blob contents, so the assignment scope controls both management-plane and data-plane exposure.

Common use cases (2)

• Assign to the Avere vFXT cluster controller identity that creates and configures cluster nodes and their supporting Azure resources.
• Operate an existing archived Avere vFXT deployment whose controller still needs to add, change, or remove cluster infrastructure.

Prerequisites (3)

• Use this role only for an existing Avere vFXT deployment; the official product documentation is in the Microsoft Learn archive.
• Plan the isolated subscription or resource group, empty subnet, controller VM, cluster nodes, and back-end storage before assignment.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target scope.

Best practices (3)

• Assign the role to the cluster controller identity rather than to general administrators or client workloads.
• Use the isolated subscription or resource group pattern documented for Avere so the wildcard compute and storage permissions do not reach unrelated resources.
• Confirm cached changes are flushed to back-end storage before deleting nodes or destroying a cluster.

Security considerations (3)

• The role can create, change, and delete virtual machines, disks, network interfaces, storage accounts, and blob data in scope.
• A broad scope exposes unrelated infrastructure and stored data to the cluster controller identity.
• The archived service boundary should be preserved; this role is not a general-purpose compute or storage administrator role.

Assignment guidance

For a maintained Avere vFXT environment, assign Avere Contributor to the documented cluster controller identity at the isolated deployment scope. Keep Avere Operator on cluster node identities, verify the controller and nodes do not share a scope with unrelated workloads, and remove assignments when the retired deployment is dismantled.

Related roles (1)

• Avere Operator: The Avere plan explicitly assigns Contributor to the cluster controller and Operator to the cluster node identities.

Editorial sources (6)

• Azure built-in roles for Storage →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Plan your Avere vFXT system →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Manage the Avere vFXT cluster →

  Supports: Common use cases, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →