Azure Storage built-in role
Backup MUA Operator
Authorizes Azure Backup critical operations protected by a Resource Guard. It is assigned on the Resource Guard side of multi-user authorization and does not replace the vault-side backup role that initiates the operation.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: f54b6d04-23c6-443e-b462-9c16ab7b4a52
Control-plane actions (3)
Microsoft.DataProtection/*/actionMicrosoft.DataProtection/*/readMicrosoft.Authorization/*/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
The role is assignable throughout the Azure hierarchy, but Microsoft documents assignment on the Resource Guard or its containing resource group or subscription. Its effect is limited to operations protected by Resource Guards in that scope; the vault and guard can be in different subscriptions or tenants but must be in the same region.
Common use cases (2)
- Approve a time-bound request to perform a protected backup operation such as disabling MUA or another configured critical operation.
- Provide the second-person authorization required when a vault backup administrator performs a protected operation.
Prerequisites (3)
- MUA must be enabled and the protected vault must be mapped to a Resource Guard in the same region.
- The principal also needs the appropriate vault-side backup role for the underlying operation.
- Configure the approver workflow before relying on PIM; Microsoft warns that requests can otherwise be automatically approved.
Best practices (3)
- Make this an eligible, time-bound PIM assignment that requires approval, MFA, and a ticket or justification.
- Keep approvers separate from backup administrators and remove manual assignments immediately after the approved operation.
- Test MUA after configuration to verify protected operations fail without active Operator access.
Security considerations (3)
- An active assignment can authorize destructive or protection-reducing backup operations guarded by MUA.
- Permanent or self-approved access eliminates the just-in-time second-person control that Resource Guard is intended to provide.
- The role has no DataActions but is still highly privileged because it unlocks critical control-plane operations.
Assignment guidance
Configure Backup MUA Operator as eligible PIM access on the isolated Resource Guard, require approval from the security team, and activate it only for the approved critical operation. The backup administrator must retain the separate vault-side role and should lose Operator access when the approval window ends.
Related roles (2)
- Backup MUA Admin: Creates and maintains the Resource Guard that Operator uses to authorize protected operations.
- Backup Contributor: Typical vault-side role that initiates protected backup operations while Operator supplies separate Resource Guard authorization.
Common questions
When should I assign the Backup MUA Operator Azure role?
Assign Backup MUA Operator when you need to: Approve a time-bound request to perform a protected backup operation such as disabling MUA or another configured critical operation.; and Provide the second-person authorization required when a vault backup administrator performs a protected operation.. Practical scope: The role is assignable throughout the Azure hierarchy, but Microsoft documents assignment on the Resource Guard or its containing resource group or subscription. Its effect is limited to operations protected by Resource Guards in that scope; the vault and guard can be in different subscriptions or tenants but must be in the same region.
What permissions does the Backup MUA Operator Azure role grant?
The role definition grants 3 combined control-plane and data-plane actions. Representative operations include: Microsoft.DataProtection/*/action; Microsoft.DataProtection/*/read; and Microsoft.Authorization/*/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Backup MUA Operator Azure role?
Key considerations when assigning Backup MUA Operator: An active assignment can authorize destructive or protection-reducing backup operations guarded by MUA.; Permanent or self-approved access eliminates the just-in-time second-person control that Resource Guard is intended to provide.; and The role has no DataActions but is still highly privileged because it unlocks critical control-plane operations.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (4)
- Azure built-in roles for Storage →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope. Retrieved 2026-07-16.
- Eligible and time-bound role assignments in Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Configure multi-user authorization using Resource Guard →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.