Azure Containers built-in role

Azure Container Storage Operator

Allows the AKS kubelet or agent-pool managed identity to perform the Azure Elastic SAN, compute, and network control-plane operations required by Azure Container Storage. It has no storage data-plane DataActions and is a service identity role, not a human storage-administration role.

Control-plane actions (18)

• Microsoft.ElasticSan/elasticSans/*
• Microsoft.ElasticSan/locations/asyncoperations/read
• Microsoft.Network/routeTables/join/action
• Microsoft.Network/networkSecurityGroups/join/action
• Microsoft.Network/virtualNetworks/write
• Microsoft.Network/virtualNetworks/delete
• Microsoft.Network/virtualNetworks/join/action
• Microsoft.Network/virtualNetworks/subnets/read
• Microsoft.Network/virtualNetworks/subnets/write
• Microsoft.Compute/virtualMachines/read
• Microsoft.Compute/virtualMachines/write
• Microsoft.Compute/virtualMachineScaleSets/read
• Microsoft.Compute/virtualMachineScaleSets/write
• Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write
• Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read
• Microsoft.Resources/subscriptions/providers/read
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Network/virtualNetworks/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Microsoft documents assigning the role to the AKS managed identity at subscription scope or narrowing it to the resource group containing the infrastructure Azure Container Storage must manage. The assignment is inherited by all matching resources below that scope.

Common use cases (1)

• Enable the AKS kubelet or agent-pool managed identity to provision and operate Azure Container Storage resources backed by Azure Elastic SAN.

Prerequisites (2)

• Identify the AKS kubelet managed identity object ID, or the user-assigned identity named with the cluster and -agentpool suffix, and choose the resource group or subscription containing the infrastructure it must operate.
• The assigning administrator needs Azure Container Storage Owner or Contributor as documented for granting this role.

Best practices (2)

• Assign to the AKS kubelet or agent-pool managed identity rather than a person and narrow scope to the infrastructure resource group when the deployment supports it.
• Keep application access to persistent-volume data governed by Kubernetes and the backing storage service; this role is for infrastructure operations.

Security considerations (2)

• The operator can change Azure virtual machines, networks, and storage infrastructure used by the cluster, affecting availability and data placement even without storage DataActions.
• Subscription scope extends that infrastructure authority across all matching resources in the subscription.

Assignment guidance

Assign Azure Container Storage Operator to the AKS kubelet or agent-pool managed identity at the narrowest documented resource group, using subscription scope only when required by the deployment. Have an authorized Container Storage Owner or Contributor create the constrained assignment.

Related roles (2)

• Azure Container Storage Contributor: Human or deployment role that installs Container Storage and can assign or remove only the Operator role under its built-in condition.
• Azure Container Storage Owner: Broader installation and Elastic SAN configuration role that can also grant the constrained Operator role.

Editorial sources (7)

• Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Use Azure Container Storage with Azure Elastic SAN →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Install Azure Container Storage with AKS →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →