Azure Storage built-in role

Avere Operator

Is the service role used by Avere vFXT cluster node identities to manage node networking, join the cluster subnet and network security group, manage blob containers, and read, write, or delete blob data used by the cluster. It is not an end-user file-access role.

Control-plane actions (11)

• Microsoft.Compute/virtualMachines/read
• Microsoft.Network/networkInterfaces/read
• Microsoft.Network/networkInterfaces/write
• Microsoft.Network/virtualNetworks/read
• Microsoft.Network/virtualNetworks/subnets/read
• Microsoft.Network/virtualNetworks/subnets/join/action
• Microsoft.Network/networkSecurityGroups/join/action
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Storage/storageAccounts/blobServices/containers/delete
• Microsoft.Storage/storageAccounts/blobServices/containers/read
• Microsoft.Storage/storageAccounts/blobServices/containers/write

Data-plane actions (3)

• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete
• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read
• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The role is assignable throughout the Azure hierarchy, but the archived Avere guidance assigns it to cluster nodes inside the isolated cluster deployment. Its limited control-plane actions still include network-interface writes and container management, while its DataActions grant blob read, write, and delete at the assigned scope.

Common use cases (2)

• Run the Avere vFXT cluster node identities that move cluster IP addresses and interact with their Blob Storage core filer.
• Add nodes to an existing Avere vFXT cluster by passing the documented Avere Operator role to the node identities.

Prerequisites (3)

• An existing Avere vFXT cluster and controller are required; the service documentation is archived.
• The cluster subnet, network security group, and approved Blob Storage core filer must already be identified.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target scope.

Best practices (3)

• Assign only to the managed identities of Avere cluster nodes, not to human users or client VMs.
• Scope the role to the isolated cluster resources and approved Blob Storage core filer.
• Shut down or destroy cluster nodes through Avere Control Panel or vfxt.py so cached writes reach back-end storage before infrastructure is removed.

Security considerations (3)

• The node identity can modify network interfaces and directly read, write, and delete blobs in scope.
• Deleting a node directly in Azure without first removing it from the cluster can cause data loss.
• Because this is a service role for an archived product, reuse by unrelated automation is unsupported by the cited Avere workflow.

Assignment guidance

Assign Avere Operator only to each Avere vFXT cluster node identity, at the smallest scope containing the cluster network resources and intended Blob Storage core filer. Keep controller duties on Avere Contributor and remove node assignments as the cluster is decommissioned.

Related roles (1)

• Avere Contributor: The Avere plan explicitly uses Contributor for the controller and Operator for cluster node identities.

Editorial sources (5)

• Azure built-in roles for Storage →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Plan your Avere vFXT system →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Manage the Avere vFXT cluster →

  Supports: Common use cases, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →