Azure Storage built-in role

Backup Operator

Performs routine Azure Backup protection, on-demand backup, restore, registration, and job operations without the Backup Contributor permissions used for policy management and destructive removal of backup data. It cannot create vaults or delegate Azure RBAC access.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: 00c29273-979b-4161-815c-10b084fb9324

Control-plane actions (103)

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

The role is assignable throughout the Azure hierarchy. Microsoft maps ordinary backup and restore operations primarily to the Recovery Services vault or Backup vault, with subscription scope required for some cross-region operations. Separate roles are often required on protected workloads, staging storage, and restore targets.

Common use cases (2)

Prerequisites (3)

Best practices (3)

Security considerations (3)

Assignment guidance

Assign Backup Operator at the vault scope for routine operations, then add only the workload and restore-target roles explicitly required by Microsoft for the task. Use Backup Contributor for approved policy or destructive protection changes and Backup Reader for monitoring only.

Related roles (2)

Common questions

When should I assign the Backup Operator Azure role?

Assign Backup Operator when you need to: Enable supported backup workloads, run on-demand backups, monitor jobs, and restore recovery points.; and Register supported on-premises backup resources and perform operational recovery work without managing backup policies or deleting retained backup data.. Practical scope: The role is assignable throughout the Azure hierarchy. Microsoft maps ordinary backup and restore operations primarily to the Recovery Services vault or Backup vault, with subscription scope required for some cross-region operations. Separate roles are often required on protected workloads, staging storage, and restore targets.

What permissions does the Backup Operator Azure role grant?

The role definition grants 103 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Network/virtualNetworks/read; Microsoft.RecoveryServices/Vaults/backupFabrics/operationResults/read; Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/operationResults/read; Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/backup/action; and Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/operationResults/read. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Backup Operator Azure role?

Key considerations when assigning Backup Operator: Restore permissions can expose protected data or write recovered resources into a target environment.; The role can trigger backup and restore and modify protected instances, even though Microsoft excludes destructive backup removal and policy management.; and Additional workload roles can make the effective access much broader than the vault assignment alone.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (6)

Official Microsoft Learn documentation →