Azure Storage built-in role

Backup MUA Operator

Authorizes Azure Backup critical operations protected by a Resource Guard. It is assigned on the Resource Guard side of multi-user authorization and does not replace the vault-side backup role that initiates the operation.

Control-plane actions (3)

• Microsoft.DataProtection/*/action
• Microsoft.DataProtection/*/read
• Microsoft.Authorization/*/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The role is assignable throughout the Azure hierarchy, but Microsoft documents assignment on the Resource Guard or its containing resource group or subscription. Its effect is limited to operations protected by Resource Guards in that scope; the vault and guard can be in different subscriptions or tenants but must be in the same region.

Common use cases (2)

• Approve a time-bound request to perform a protected backup operation such as disabling MUA or another configured critical operation.
• Provide the second-person authorization required when a vault backup administrator performs a protected operation.

Prerequisites (3)

• MUA must be enabled and the protected vault must be mapped to a Resource Guard in the same region.
• The principal also needs the appropriate vault-side backup role for the underlying operation.
• Configure the approver workflow before relying on PIM; Microsoft warns that requests can otherwise be automatically approved.

Best practices (3)

• Make this an eligible, time-bound PIM assignment that requires approval, MFA, and a ticket or justification.
• Keep approvers separate from backup administrators and remove manual assignments immediately after the approved operation.
• Test MUA after configuration to verify protected operations fail without active Operator access.

Security considerations (3)

• An active assignment can authorize destructive or protection-reducing backup operations guarded by MUA.
• Permanent or self-approved access eliminates the just-in-time second-person control that Resource Guard is intended to provide.
• The role has no DataActions but is still highly privileged because it unlocks critical control-plane operations.

Assignment guidance

Configure Backup MUA Operator as eligible PIM access on the isolated Resource Guard, require approval from the security team, and activate it only for the approved critical operation. The backup administrator must retain the separate vault-side role and should lose Operator access when the approval window ends.

Related roles (2)

• Backup MUA Admin: Creates and maintains the Resource Guard that Operator uses to authorize protected operations.
• Backup Contributor: Typical vault-side role that initiates protected backup operations while Operator supplies separate Resource Guard authorization.

Editorial sources (4)

• Azure built-in roles for Storage →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope. Retrieved 2026-07-16.

• Eligible and time-bound role assignments in Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Configure multi-user authorization using Resource Guard →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →