Azure Containers built-in role
Azure Container Storage Contributor
Installs and manages the Azure Container Storage Kubernetes extension and ARM deployments. It can create or delete role assignments only for Azure Container Storage Operator under the built-in condition. It has no Microsoft.ElasticSan or Microsoft.Storage Actions and no storage DataActions, so it does not itself manage Elastic SAN or Azure Storage resources.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 95dd08a6-00bd-4661-84bf-f6726f83a4d0
Control-plane actions (12)
Microsoft.KubernetesConfiguration/extensions/writeMicrosoft.KubernetesConfiguration/extensions/readMicrosoft.KubernetesConfiguration/extensions/deleteMicrosoft.KubernetesConfiguration/extensions/operations/readMicrosoft.Authorization/*/readMicrosoft.Resources/subscriptions/resourceGroups/readMicrosoft.Resources/subscriptions/readMicrosoft.Management/managementGroups/readMicrosoft.Resources/deployments/*Microsoft.Support/*Microsoft.Authorization/roleAssignments/writeMicrosoft.Authorization/roleAssignments/delete
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Conditions (1)
Condition version: 2.0
((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619}))
Assignable scopes (1)
/
Practical scope
Microsoft documents this role at subscription scope for installation, although the resulting Operator assignment can be narrowed to a resource group. Because Azure assignments inherit, subscription scope gives the contributor its published Container Storage management authority across that subscription.
Common use cases (1)
- Allow a platform installer to deploy or maintain the Azure Container Storage extension and grant the AKS kubelet or agent-pool identity the constrained Operator role.
Prerequisites (2)
- Prepare a supported AKS cluster, extension deployment, backing storage choice, subscription, resource group, network, and AKS kubelet or agent-pool managed identity.
- Confirm that the built-in role-assignment condition remains intact and that only Azure Container Storage Operator assignments are required.
Best practices (2)
- Use the built-in conditioned role rather than a broader role-assignment administrator for Container Storage installation.
- Assign for the installation and maintenance team only, review Operator assignment scopes, and remove standing access when ongoing administration is unnecessary.
Security considerations (2)
- The role can install, update, or remove the Container Storage extension, create ARM deployments, and create or delete Azure Container Storage Operator assignments within the built-in condition.
- It cannot directly manage Elastic SAN or Azure Storage resources; the delegated Operator identity supplies the runtime infrastructure authority, so its identity and assignment scope are security-critical.
Assignment guidance
Assign Azure Container Storage Contributor to the approved installer at the documented subscription scope only where it owns the extension deployment. Preserve the built-in condition and use its delegation solely to assign Operator to the AKS kubelet or agent-pool identity at the narrowest infrastructure scope.
Related roles (2)
- Azure Container Storage Operator: The only role this contributor is conditionally authorized to assign or remove.
- Azure Container Storage Owner: Adds the broader Elastic SAN configuration and installation authority documented for Container Storage.
Common questions
When should I assign the Azure Container Storage Contributor Azure role?
Assign Azure Container Storage Contributor when you need to: Allow a platform installer to deploy or maintain the Azure Container Storage extension and grant the AKS kubelet or agent-pool identity the constrained Operator role.. Practical scope: Microsoft documents this role at subscription scope for installation, although the resulting Operator assignment can be narrowed to a resource group. Because Azure assignments inherit, subscription scope gives the contributor its published Container Storage management authority across that subscription.
What permissions does the Azure Container Storage Contributor Azure role grant?
The role definition grants 12 combined control-plane and data-plane actions. Representative operations include: Microsoft.KubernetesConfiguration/extensions/write; Microsoft.KubernetesConfiguration/extensions/read; Microsoft.KubernetesConfiguration/extensions/delete; Microsoft.KubernetesConfiguration/extensions/operations/read; Microsoft.Authorization/*/read; and Microsoft.Resources/subscriptions/resourceGroups/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Container Storage Contributor Azure role?
Key considerations when assigning Azure Container Storage Contributor: The role can install, update, or remove the Container Storage extension, create ARM deployments, and create or delete Azure Container Storage Operator assignments within the built-in condition.; and It cannot directly manage Elastic SAN or Azure Storage resources; the delegated Operator identity supplies the runtime infrastructure authority, so its identity and assignment scope are security-critical.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Use Azure Container Storage with Azure Elastic SAN →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Install Azure Container Storage with AKS →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.