Azure Containers built-in role
Azure Container Storage Operator
Allows the AKS kubelet or agent-pool managed identity to perform the Azure Elastic SAN, compute, and network control-plane operations required by Azure Container Storage. It has no storage data-plane DataActions and is a service identity role, not a human storage-administration role.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 08d4c71a-cc63-4ce4-a9c8-5dd251b4d619
Control-plane actions (18)
Microsoft.ElasticSan/elasticSans/*Microsoft.ElasticSan/locations/asyncoperations/readMicrosoft.Network/routeTables/join/actionMicrosoft.Network/networkSecurityGroups/join/actionMicrosoft.Network/virtualNetworks/writeMicrosoft.Network/virtualNetworks/deleteMicrosoft.Network/virtualNetworks/join/actionMicrosoft.Network/virtualNetworks/subnets/readMicrosoft.Network/virtualNetworks/subnets/writeMicrosoft.Compute/virtualMachines/readMicrosoft.Compute/virtualMachines/writeMicrosoft.Compute/virtualMachineScaleSets/readMicrosoft.Compute/virtualMachineScaleSets/writeMicrosoft.Compute/virtualMachineScaleSets/virtualMachines/writeMicrosoft.Compute/virtualMachineScaleSets/virtualMachines/readMicrosoft.Resources/subscriptions/providers/readMicrosoft.Resources/subscriptions/resourceGroups/readMicrosoft.Network/virtualNetworks/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Microsoft documents assigning the role to the AKS managed identity at subscription scope or narrowing it to the resource group containing the infrastructure Azure Container Storage must manage. The assignment is inherited by all matching resources below that scope.
Common use cases (1)
- Enable the AKS kubelet or agent-pool managed identity to provision and operate Azure Container Storage resources backed by Azure Elastic SAN.
Prerequisites (2)
- Identify the AKS kubelet managed identity object ID, or the user-assigned identity named with the cluster and -agentpool suffix, and choose the resource group or subscription containing the infrastructure it must operate.
- The assigning administrator needs Azure Container Storage Owner or Contributor as documented for granting this role.
Best practices (2)
- Assign to the AKS kubelet or agent-pool managed identity rather than a person and narrow scope to the infrastructure resource group when the deployment supports it.
- Keep application access to persistent-volume data governed by Kubernetes and the backing storage service; this role is for infrastructure operations.
Security considerations (2)
- The operator can change Azure virtual machines, networks, and storage infrastructure used by the cluster, affecting availability and data placement even without storage DataActions.
- Subscription scope extends that infrastructure authority across all matching resources in the subscription.
Assignment guidance
Assign Azure Container Storage Operator to the AKS kubelet or agent-pool managed identity at the narrowest documented resource group, using subscription scope only when required by the deployment. Have an authorized Container Storage Owner or Contributor create the constrained assignment.
Related roles (2)
- Azure Container Storage Contributor: Human or deployment role that installs Container Storage and can assign or remove only the Operator role under its built-in condition.
- Azure Container Storage Owner: Broader installation and Elastic SAN configuration role that can also grant the constrained Operator role.
Common questions
When should I assign the Azure Container Storage Operator Azure role?
Assign Azure Container Storage Operator when you need to: Enable the AKS kubelet or agent-pool managed identity to provision and operate Azure Container Storage resources backed by Azure Elastic SAN.. Practical scope: Microsoft documents assigning the role to the AKS managed identity at subscription scope or narrowing it to the resource group containing the infrastructure Azure Container Storage must manage. The assignment is inherited by all matching resources below that scope.
What permissions does the Azure Container Storage Operator Azure role grant?
The role definition grants 18 combined control-plane and data-plane actions. Representative operations include: Microsoft.ElasticSan/elasticSans/*; Microsoft.ElasticSan/locations/asyncoperations/read; Microsoft.Network/routeTables/join/action; Microsoft.Network/networkSecurityGroups/join/action; Microsoft.Network/virtualNetworks/write; and Microsoft.Network/virtualNetworks/delete. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Container Storage Operator Azure role?
Key considerations when assigning Azure Container Storage Operator: The operator can change Azure virtual machines, networks, and storage infrastructure used by the cluster, affecting availability and data placement even without storage DataActions.; and Subscription scope extends that infrastructure authority across all matching resources in the subscription.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Use Azure Container Storage with Azure Elastic SAN →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Install Azure Container Storage with AKS →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.