Azure Containers built-in role

Azure Container Storage Owner

Installs Azure Container Storage, grants its managed identity access, and configures Azure Elastic SAN resources. It has broad Azure control-plane deployment and support operations plus role-assignment write and delete authority constrained by a built-in condition to Azure Container Storage Operator; it has no storage data-plane DataActions.

Control-plane actions (17)

• Microsoft.ElasticSan/elasticSans/*
• Microsoft.ElasticSan/locations/*
• Microsoft.ElasticSan/elasticSans/volumeGroups/*
• Microsoft.ElasticSan/elasticSans/volumeGroups/volumes/*
• Microsoft.ElasticSan/locations/asyncoperations/read
• Microsoft.KubernetesConfiguration/extensions/write
• Microsoft.KubernetesConfiguration/extensions/read
• Microsoft.KubernetesConfiguration/extensions/delete
• Microsoft.KubernetesConfiguration/extensions/operations/read
• Microsoft.Authorization/*/read
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Resources/subscriptions/read
• Microsoft.Management/managementGroups/read
• Microsoft.Resources/deployments/*
• Microsoft.Support/*
• Microsoft.Authorization/roleAssignments/write
• Microsoft.Authorization/roleAssignments/delete

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Conditions (1)

• Condition version: 2.0

  ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619}))

Assignable scopes (1)

• /

Practical scope

Microsoft documents this role at subscription scope for installation and Elastic SAN setup. The assignment is inherited throughout the subscription, while Operator assignments should be narrowed to the AKS infrastructure resource group when supported.

Common use cases (1)

• Allow the designated storage platform owner to install Azure Container Storage with Elastic SAN and grant the AKS managed identity its constrained Operator access.

Prerequisites (2)

• Prepare the supported AKS cluster, Elastic SAN design, network and resource groups, AKS managed identity, capacity, resilience, and cost controls.
• Verify the built-in role-assignment condition and the exact Operator assignment scope before installation.

Best practices (2)

• Restrict the role to the small storage platform team, use eligible or time-bound access where available, and audit all deployments and Operator assignment changes.
• Use Contributor when the broader Owner capabilities are not required and assign Operator only to the AKS managed identity.

Security considerations (2)

• The role can deploy and configure storage infrastructure and grant or revoke the service operator role, materially affecting cluster storage availability and placement.
• Its conditioned role-assignment authority is narrower than general role administration, but the remaining control-plane authority is still broad and should not be treated as a default assignment.

Assignment guidance

Assign Azure Container Storage Owner only to the storage platform owner for subscriptions that require its full installation and Elastic SAN workflow. Prefer Contributor when sufficient, preserve the built-in condition, and scope Operator to the AKS managed identity and infrastructure boundary.

Related roles (2)

• Azure Container Storage Contributor: Narrower installation and storage-management role that retains the conditioned Operator delegation.
• Azure Container Storage Operator: Service identity role conditionally granted to the AKS managed identity.

Editorial sources (6)

• Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Use Azure Container Storage with Azure Elastic SAN →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →