Azure Storage built-in role

Backup MUA Admin

Creates, updates, and deletes Azure Backup Resource Guards and manages their protected-operation configuration and vault proxies. This is the security-administration side of Azure Backup multi-user authorization, separate from ordinary vault backup administration.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: c2a970b4-16a7-4a51-8c84-8a8ea6ee0bb8

Control-plane actions (26)

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

The role is assignable throughout the Azure hierarchy, but MUA guidance places it on the Resource Guard or its isolated containing scope. Microsoft recommends a Resource Guard in another subscription or tenant, in the same region as the protected vault, so the backup administrator cannot control both sides of authorization.

Common use cases (2)

Prerequisites (3)

Best practices (3)

Security considerations (3)

Assignment guidance

Assign Backup MUA Admin to the separate security team at the Resource Guard scope. Do not assign it to vault backup administrators, keep the Resource Guard isolated, and use Backup MUA Operator as eligible just-in-time access for approved protected operations.

Related roles (2)

Common questions

When should I assign the Backup MUA Admin Azure role?

Assign Backup MUA Admin when you need to: Create and maintain Resource Guards that protect critical Recovery Services vault or Backup vault operations.; and Define protected operations and manage Resource Guard proxies while keeping approval authority outside the backup operations team.. Practical scope: The role is assignable throughout the Azure hierarchy, but MUA guidance places it on the Resource Guard or its isolated containing scope. Microsoft recommends a Resource Guard in another subscription or tenant, in the same region as the protected vault, so the backup administrator cannot control both sides of authorization.

What permissions does the Backup MUA Admin Azure role grant?

The role definition grants 26 combined control-plane and data-plane actions. Representative operations include: Microsoft.DataProtection/*/read; Microsoft.DataProtection/*/resourceGuards/write; Microsoft.DataProtection/subscriptions/resourceGroups/providers/resourceGuards/write; Microsoft.DataProtection/subscriptions/resourceGroups/providers/resourceGuards/delete; Microsoft.DataProtection/subscriptions/resourceGroups/providers/resourceGuards/read; and Microsoft.DataProtection/locations/operationResults/read. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Backup MUA Admin Azure role?

Key considerations when assigning Backup MUA Admin: An MUA administrator can change or delete the Resource Guard and its protection configuration, weakening the second-person control if compromised.; Combining this role with backup-vault administration defeats the intended separation of duties.; and The role has no DataActions, but it controls the security boundary around destructive backup operations.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (4)

Official Microsoft Learn documentation →