Azure Storage built-in role

Backup Operator

Performs routine Azure Backup protection, on-demand backup, restore, registration, and job operations without the Backup Contributor permissions used for policy management and destructive removal of backup data. It cannot create vaults or delegate Azure RBAC access.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: 00c29273-979b-4161-815c-10b084fb9324

Control-plane actions (103)

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

The role is assignable throughout the Azure hierarchy. Microsoft maps ordinary backup and restore operations primarily to the Recovery Services vault or Backup vault, with subscription scope required for some cross-region operations. Separate roles are often required on protected workloads, staging storage, and restore targets.

Common use cases (2)

Prerequisites (3)

Best practices (3)

Security considerations (3)

Assignment guidance

Assign Backup Operator at the vault scope for routine operations, then add only the workload and restore-target roles explicitly required by Microsoft for the task. Use Backup Contributor for approved policy or destructive protection changes and Backup Reader for monitoring only.

Related roles (2)

Editorial sources (6)

Official Microsoft Learn documentation →