Azure Containers built-in role

Azure Container Storage Contributor

Installs and manages the Azure Container Storage Kubernetes extension and ARM deployments. It can create or delete role assignments only for Azure Container Storage Operator under the built-in condition. It has no Microsoft.ElasticSan or Microsoft.Storage Actions and no storage DataActions, so it does not itself manage Elastic SAN or Azure Storage resources.

Control-plane actions (12)

• Microsoft.KubernetesConfiguration/extensions/write
• Microsoft.KubernetesConfiguration/extensions/read
• Microsoft.KubernetesConfiguration/extensions/delete
• Microsoft.KubernetesConfiguration/extensions/operations/read
• Microsoft.Authorization/*/read
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Resources/subscriptions/read
• Microsoft.Management/managementGroups/read
• Microsoft.Resources/deployments/*
• Microsoft.Support/*
• Microsoft.Authorization/roleAssignments/write
• Microsoft.Authorization/roleAssignments/delete

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Conditions (1)

• Condition version: 2.0

  ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619}))

Assignable scopes (1)

• /

Practical scope

Microsoft documents this role at subscription scope for installation, although the resulting Operator assignment can be narrowed to a resource group. Because Azure assignments inherit, subscription scope gives the contributor its published Container Storage management authority across that subscription.

Common use cases (1)

• Allow a platform installer to deploy or maintain the Azure Container Storage extension and grant the AKS kubelet or agent-pool identity the constrained Operator role.

Prerequisites (2)

• Prepare a supported AKS cluster, extension deployment, backing storage choice, subscription, resource group, network, and AKS kubelet or agent-pool managed identity.
• Confirm that the built-in role-assignment condition remains intact and that only Azure Container Storage Operator assignments are required.

Best practices (2)

• Use the built-in conditioned role rather than a broader role-assignment administrator for Container Storage installation.
• Assign for the installation and maintenance team only, review Operator assignment scopes, and remove standing access when ongoing administration is unnecessary.

Security considerations (2)

• The role can install, update, or remove the Container Storage extension, create ARM deployments, and create or delete Azure Container Storage Operator assignments within the built-in condition.
• It cannot directly manage Elastic SAN or Azure Storage resources; the delegated Operator identity supplies the runtime infrastructure authority, so its identity and assignment scope are security-critical.

Assignment guidance

Assign Azure Container Storage Contributor to the approved installer at the documented subscription scope only where it owns the extension deployment. Preserve the built-in condition and use its delegation solely to assign Operator to the AKS kubelet or agent-pool identity at the narrowest infrastructure scope.

Related roles (2)

• Azure Container Storage Operator: The only role this contributor is conditionally authorized to assign or remove.
• Azure Container Storage Owner: Adds the broader Elastic SAN configuration and installation authority documented for Container Storage.

Editorial sources (7)

• Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Use Azure Container Storage with Azure Elastic SAN →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Install Azure Container Storage with AKS →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →