Azure Storage built-in role

Backup Contributor

Administers Azure Backup management operations for Recovery Services vaults and Backup vaults, including policies, protected items, backup instances, backup and restore operations, and destructive protection changes. It cannot delegate Azure RBAC access and does not grant workload data-plane access through DataActions.

Control-plane actions (89)

• Microsoft.Authorization/*/read
• Microsoft.Network/virtualNetworks/read
• Microsoft.RecoveryServices/locations/*
• Microsoft.RecoveryServices/Vaults/backupFabrics/operationResults/*
• Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/*
• Microsoft.RecoveryServices/Vaults/backupFabrics/refreshContainers/action
• Microsoft.RecoveryServices/Vaults/backupJobs/*
• Microsoft.RecoveryServices/Vaults/backupJobsExport/action
• Microsoft.RecoveryServices/Vaults/backupOperationResults/*
• Microsoft.RecoveryServices/Vaults/backupPolicies/*
• Microsoft.RecoveryServices/Vaults/backupProtectableItems/*
• Microsoft.RecoveryServices/Vaults/backupProtectedItems/*
• Microsoft.RecoveryServices/Vaults/backupProtectionContainers/*
• Microsoft.RecoveryServices/Vaults/backupSecurityPIN/*
• Microsoft.RecoveryServices/Vaults/backupUsageSummaries/read
• Microsoft.RecoveryServices/Vaults/certificates/*
• Microsoft.RecoveryServices/Vaults/extendedInformation/*
• Microsoft.RecoveryServices/Vaults/monitoringAlerts/read
• Microsoft.RecoveryServices/Vaults/monitoringConfigurations/*
• Microsoft.RecoveryServices/Vaults/read
• Microsoft.RecoveryServices/Vaults/registeredIdentities/*
• Microsoft.RecoveryServices/Vaults/usages/*
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Storage/storageAccounts/read
• Microsoft.RecoveryServices/Vaults/backupstorageconfig/*
• Microsoft.RecoveryServices/Vaults/backupconfig/*
• Microsoft.RecoveryServices/Vaults/backupValidateOperation/action
• Microsoft.RecoveryServices/Vaults/write
• Microsoft.RecoveryServices/Vaults/backupOperations/read
• Microsoft.RecoveryServices/Vaults/backupEngines/read
• Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/*
• Microsoft.RecoveryServices/Vaults/backupFabrics/protectableContainers/read
• Microsoft.RecoveryServices/vaults/operationStatus/read
• Microsoft.RecoveryServices/vaults/operationResults/read
• Microsoft.RecoveryServices/locations/backupStatus/action
• Microsoft.RecoveryServices/locations/backupPreValidateProtection/action
• Microsoft.RecoveryServices/locations/backupValidateFeatures/action
• Microsoft.RecoveryServices/Vaults/monitoringAlerts/write
• Microsoft.RecoveryServices/operations/read
• Microsoft.RecoveryServices/locations/operationStatus/read
• Microsoft.RecoveryServices/Vaults/backupProtectionIntents/read
• Microsoft.Support/*
• Microsoft.DataProtection/locations/getBackupStatus/action
• Microsoft.DataProtection/backupVaults/backupInstances/write
• Microsoft.DataProtection/backupVaults/backupInstances/delete
• Microsoft.DataProtection/backupVaults/backupInstances/read
• Microsoft.DataProtection/backupVaults/backupInstances/read
• Microsoft.DataProtection/backupVaults/deletedBackupInstances/read
• Microsoft.DataProtection/backupVaults/deletedBackupInstances/undelete/action
• Microsoft.DataProtection/backupVaults/backupInstances/backup/action
• Microsoft.DataProtection/backupVaults/backupInstances/validateRestore/action
• Microsoft.DataProtection/backupVaults/backupInstances/restore/action
• Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/crossRegionRestore/action
• Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/validateCrossRegionRestore/action
• Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJobs/action
• Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJob/action
• Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchSecondaryRecoveryPoints/action
• Microsoft.DataProtection/backupVaults/backupPolicies/write
• Microsoft.DataProtection/backupVaults/backupPolicies/delete
• Microsoft.DataProtection/backupVaults/backupPolicies/read
• Microsoft.DataProtection/backupVaults/backupPolicies/read
• Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read
• Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read
• Microsoft.DataProtection/backupVaults/backupInstances/findRestorableTimeRanges/action
• Microsoft.DataProtection/backupVaults/backupInstances/operationResults/read
• Microsoft.DataProtection/backupVaults/write
• Microsoft.DataProtection/backupVaults/read
• Microsoft.DataProtection/backupVaults/operationResults/read
• Microsoft.DataProtection/backupVaults/operationStatus/read
• Microsoft.DataProtection/locations/checkNameAvailability/action
• Microsoft.DataProtection/locations/checkFeatureSupport/action
• Microsoft.DataProtection/backupVaults/read
• Microsoft.DataProtection/backupVaults/read
• Microsoft.DataProtection/locations/operationStatus/read
• Microsoft.DataProtection/locations/operationResults/read
• Microsoft.DataProtection/backupVaults/validateForBackup/action
• Microsoft.DataProtection/operations/read
• Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/delete
• Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/read
• Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/unlockDelete/action
• Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/write
• Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/read
• Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/write
• Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/delete
• Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/unlockDelete/action
• Microsoft.DataProtection/backupVaults/backupInstances/validateForModifyBackup/action
• Microsoft.DataProtection/backupVaults/backupInstances/SuspendBackups/action
• Microsoft.DataProtection/backupVaults/backupInstances/resumeProtection/action

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The role is assignable throughout the Azure hierarchy. Microsoft maps most policy and destructive backup operations to the Recovery Services vault or Backup vault, while creating a vault uses the containing resource group and some cross-region operations use the subscription. Separate roles can be required on protected or restore-target resources.

Common use cases (2)

• Create and manage backup policies, protection configuration, backup instances, recovery points, and restores for supported Azure Backup workloads.
• Stop protection, delete backup data or registrations where supported, and administer vault backup configuration without granting access to others.

Prerequisites (3)

• Identify the vault type, protected workload, source resource, restore target, and the exact scopes in Microsoft's workload-specific role matrix.
• Grant any separately documented VM, database, disk, storage-account, or target-resource roles required by the operation.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at each target scope.

Best practices (3)

• Use Backup Operator for routine backup and restore work that does not require policy management or destructive protection changes.
• Enable multi-user authorization with a separately administered Resource Guard for protected critical operations.
• Assign at the vault or documented workload scope and use eligible, time-bound access for human backup administrators where available.

Security considerations (3)

• The role can stop protection, delete backup instances or policies, undelete soft-deleted instances, restore data, and disable vault immutability where the operation is supported.
• Backup and restore workflows can require additional roles over source and target resources, increasing the effective blast radius beyond the vault.
• It has no DataActions, but control of recovery points and destructive backup settings is highly privileged.

Assignment guidance

Reserve Backup Contributor for backup administrators who need policy or destructive protection management. Scope it to the vault or resource group documented for the workload, grant target-resource permissions separately, and protect critical operations with MUA so a Backup Contributor alone cannot authorize them.

Related roles (3)

• Backup Operator: Microsoft documents Operator for routine backup and restore while Contributor adds policy management and destructive operations.
• Backup Reader: Monitoring-only backup role.
• Backup MUA Operator: Separate Resource Guard role required to authorize operations protected by multi-user authorization.

Editorial sources (7)

• Azure built-in roles for Storage →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Eligible and time-bound role assignments in Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Manage backups with Azure role-based access control →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Configure multi-user authorization using Resource Guard →

  Supports: Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →