Azure Storage built-in role
Avere Operator
Is the service role used by Avere vFXT cluster node identities to manage node networking, join the cluster subnet and network security group, manage blob containers, and read, write, or delete blob data used by the cluster. It is not an end-user file-access role.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: c025889f-8102-4ebf-b32c-fc0c6f0c6bd9
Control-plane actions (11)
Microsoft.Compute/virtualMachines/readMicrosoft.Network/networkInterfaces/readMicrosoft.Network/networkInterfaces/writeMicrosoft.Network/virtualNetworks/readMicrosoft.Network/virtualNetworks/subnets/readMicrosoft.Network/virtualNetworks/subnets/join/actionMicrosoft.Network/networkSecurityGroups/join/actionMicrosoft.Resources/subscriptions/resourceGroups/readMicrosoft.Storage/storageAccounts/blobServices/containers/deleteMicrosoft.Storage/storageAccounts/blobServices/containers/readMicrosoft.Storage/storageAccounts/blobServices/containers/write
Data-plane actions (3)
Microsoft.Storage/storageAccounts/blobServices/containers/blobs/deleteMicrosoft.Storage/storageAccounts/blobServices/containers/blobs/readMicrosoft.Storage/storageAccounts/blobServices/containers/blobs/write
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
The role is assignable throughout the Azure hierarchy, but the archived Avere guidance assigns it to cluster nodes inside the isolated cluster deployment. Its limited control-plane actions still include network-interface writes and container management, while its DataActions grant blob read, write, and delete at the assigned scope.
Common use cases (2)
- Run the Avere vFXT cluster node identities that move cluster IP addresses and interact with their Blob Storage core filer.
- Add nodes to an existing Avere vFXT cluster by passing the documented Avere Operator role to the node identities.
Prerequisites (3)
- An existing Avere vFXT cluster and controller are required; the service documentation is archived.
- The cluster subnet, network security group, and approved Blob Storage core filer must already be identified.
- The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target scope.
Best practices (3)
- Assign only to the managed identities of Avere cluster nodes, not to human users or client VMs.
- Scope the role to the isolated cluster resources and approved Blob Storage core filer.
- Shut down or destroy cluster nodes through Avere Control Panel or vfxt.py so cached writes reach back-end storage before infrastructure is removed.
Security considerations (3)
- The node identity can modify network interfaces and directly read, write, and delete blobs in scope.
- Deleting a node directly in Azure without first removing it from the cluster can cause data loss.
- Because this is a service role for an archived product, reuse by unrelated automation is unsupported by the cited Avere workflow.
Assignment guidance
Assign Avere Operator only to each Avere vFXT cluster node identity, at the smallest scope containing the cluster network resources and intended Blob Storage core filer. Keep controller duties on Avere Contributor and remove node assignments as the cluster is decommissioned.
Related roles (1)
- Avere Contributor: The Avere plan explicitly uses Contributor for the controller and Operator for cluster node identities.
Common questions
When should I assign the Avere Operator Azure role?
Assign Avere Operator when you need to: Run the Avere vFXT cluster node identities that move cluster IP addresses and interact with their Blob Storage core filer.; and Add nodes to an existing Avere vFXT cluster by passing the documented Avere Operator role to the node identities.. Practical scope: The role is assignable throughout the Azure hierarchy, but the archived Avere guidance assigns it to cluster nodes inside the isolated cluster deployment. Its limited control-plane actions still include network-interface writes and container management, while its DataActions grant blob read, write, and delete at the assigned scope.
What permissions does the Avere Operator Azure role grant?
The role definition grants 14 combined control-plane and data-plane actions. Representative operations include: Microsoft.Compute/virtualMachines/read; Microsoft.Network/networkInterfaces/read; Microsoft.Network/networkInterfaces/write; Microsoft.Network/virtualNetworks/read; Microsoft.Network/virtualNetworks/subnets/read; and Microsoft.Network/virtualNetworks/subnets/join/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Avere Operator Azure role?
Key considerations when assigning Avere Operator: The node identity can modify network interfaces and directly read, write, and delete blobs in scope.; Deleting a node directly in Azure without first removing it from the cluster can cause data loss.; and Because this is a service role for an archived product, reuse by unrelated automation is unsupported by the cited Avere workflow.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for Storage →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Plan your Avere vFXT system →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Manage the Avere vFXT cluster →
Supports: Common use cases, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.