Azure Compute built-in role

Data Operator for Managed Disks

Uploads VHD data only to empty managed disks and reads or exports data from detached managed disks and snapshots. Microsoft Learn explicitly does not support uploading a VHD to an empty snapshot. In the secured workflow, the SAS URI identifies the transfer endpoint and Microsoft Entra ID authorizes the requesting identity.

Control-plane actions (0)

None — this role grants no control-plane management actions.

Data-plane actions (4)

• Microsoft.Compute/disks/download/action
• Microsoft.Compute/disks/upload/action
• Microsoft.Compute/snapshots/download/action
• Microsoft.Compute/snapshots/upload/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign at the specific disk or snapshot whenever possible; resource-group or broader assignments are inherited by every contained disk and snapshot. The role grants only data-plane upload and download operations, so a separate control-plane role is required to inspect resources or initiate the surrounding workflow.

Common use cases (2)

• Upload a VHD into an approved empty managed disk by using Microsoft Entra-secured disk transfer.
• Read or export the contents of a detached managed disk or a snapshot without granting broad disk management.

Prerequisites (3)

• For upload, use an empty managed disk; snapshots are download or export sources only and don't support VHD upload.
• For disk download, the disk can't be attached to a running VM; create and download a snapshot when the VM must remain running.
• Enable the disk data-access authentication mode for Microsoft Entra ID and assign Data Operator for Managed Disks to the transfer identity.

Best practices (3)

• Assign directly on the disk or snapshot and only for the transfer window.
• Use the shortest practical SAS lifetime, transmit the URI only over approved channels, and revoke disk access immediately after transfer.
• Prefer a snapshot when production downtime is unacceptable and validate the downloaded or uploaded image before use.

Security considerations (3)

• The supported DataActions can expose a full disk or snapshot or replace the contents of an empty disk, including credentials, keys, personal data, and application data stored in the image.
• The SAS URI is sensitive and must be protected and revoked after use. When Microsoft Entra data-access authentication is enabled, possession of the URI alone is insufficient; Azure also validates the caller identity and role permission.
• The lack of control-plane Actions does not make the role read-only: it includes managed-disk upload as well as managed-disk and snapshot download authority.

Assignment guidance

Grant Data Operator for Managed Disks temporarily on the individual empty disk being uploaded or the individual disk or snapshot being exported. Have a separately authorized resource operator configure Microsoft Entra data-access mode and issue or revoke the SAS, then revoke both the SAS and this data role after validation.

Editorial sources (6)

• Azure built-in roles for Compute →

  Supports: Description. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Secure uploads and downloads with Microsoft Entra ID for Azure managed disks →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• Download a Windows VHD from Azure →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →