Azure Compute built-in role

Data Operator for Managed Disks

Uploads VHD data only to empty managed disks and reads or exports data from detached managed disks and snapshots. Microsoft Learn explicitly does not support uploading a VHD to an empty snapshot. In the secured workflow, the SAS URI identifies the transfer endpoint and Microsoft Entra ID authorizes the requesting identity.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: 959f8984-c045-4866-89c7-12bf9737be2e

Control-plane actions (0)

None — this role grants no control-plane management actions.

Data-plane actions (4)

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

Assign at the specific disk or snapshot whenever possible; resource-group or broader assignments are inherited by every contained disk and snapshot. The role grants only data-plane upload and download operations, so a separate control-plane role is required to inspect resources or initiate the surrounding workflow.

Common use cases (2)

Prerequisites (3)

Best practices (3)

Security considerations (3)

Assignment guidance

Grant Data Operator for Managed Disks temporarily on the individual empty disk being uploaded or the individual disk or snapshot being exported. Have a separately authorized resource operator configure Microsoft Entra data-access mode and issue or revoke the SAS, then revoke both the SAS and this data role after validation.

Common questions

When should I assign the Data Operator for Managed Disks Azure role?

Assign Data Operator for Managed Disks when you need to: Upload a VHD into an approved empty managed disk by using Microsoft Entra-secured disk transfer.; and Read or export the contents of a detached managed disk or a snapshot without granting broad disk management.. Practical scope: Assign at the specific disk or snapshot whenever possible; resource-group or broader assignments are inherited by every contained disk and snapshot. The role grants only data-plane upload and download operations, so a separate control-plane role is required to inspect resources or initiate the surrounding workflow.

What permissions does the Data Operator for Managed Disks Azure role grant?

The role definition grants 4 combined control-plane and data-plane actions. Representative operations include: Microsoft.Compute/disks/download/action; Microsoft.Compute/disks/upload/action; Microsoft.Compute/snapshots/download/action; and Microsoft.Compute/snapshots/upload/action. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Data Operator for Managed Disks Azure role?

Key considerations when assigning Data Operator for Managed Disks: The supported DataActions can expose a full disk or snapshot or replace the contents of an empty disk, including credentials, keys, personal data, and application data stored in the image.; The SAS URI is sensitive and must be protected and revoked after use. When Microsoft Entra data-access authentication is enabled, possession of the URI alone is insufficient; Azure also validates the caller identity and role permission.; and The lack of control-plane Actions does not make the role read-only: it includes managed-disk upload as well as managed-disk and snapshot download authority.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (6)

Official Microsoft Learn documentation →