Azure Storage built-in role

Defender for Storage Data Scanner

Is the service role used by the system-assigned managed identity of the Defender for Storage StorageDataScanner resource. It reads blobs, reads Azure Files through privileged backup semantics that bypass file ACLs, reads and writes blob index tags, and includes blob deletion for supported remediation; it is not a general security-analyst role.

Control-plane actions (3)

• Microsoft.Storage/storageAccounts/blobServices/containers/read
• Microsoft.Storage/storageAccounts/blobServices/read
• Microsoft.Storage/storageAccounts/fileServices/shares/read

Data-plane actions (6)

• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read
• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/write
• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/read
• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete
• Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read
• Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Microsoft Defender for Storage creates the StorageDataScanner resource in the subscription and assigns this role so the scanner can reach protected storage data. Scope should be limited to the storage accounts being scanned; the role contains both management-plane listing Actions and direct blob/file DataActions.

Common use cases (2)

• Allow the Defender for Storage managed scanner to read content for on-upload or on-demand malware scanning.
• Let the scanning service write scan-result index tags and perform configured malicious-blob remediation.

Prerequisites (3)

• Defender for Storage and the selected malware-scanning mode must be enabled for the subscription or storage account.
• The Microsoft.EventGrid provider and automatically deployed scanning resources must remain intact for on-upload scanning.
• Assign this role to the StorageDataScanner managed identity, not to a human user.

Best practices (3)

• Let Defender for Storage create and maintain the scanner identity and its required assignment.
• Do not delete or manually repurpose the StorageDataScanner resource; re-enable the feature to repair missing resources or permissions.
• Use scan-result alerts, Event Grid, or Log Analytics for security-sensitive workflows because blob index tags are not tamper-resistant.

Security considerations (3)

• The scanner identity can read protected blob contents, bypass Azure Files ACLs through read backup semantics, update blob tags, and delete blobs.
• Changing or broadening the assignment exposes more storage data to the scanning identity, while removing it can stop malware scanning or remediation.
• Scan results in blob index tags can be altered by other principals with tag-write permission and should not be the sole security control.

Assignment guidance

Use this role only for the Defender-created StorageDataScanner managed identity and only on storage accounts covered by the scanning configuration. Preserve the managed service resources and verify scanning health after any authorization or network change.

Editorial sources (3)

• Azure built-in roles for Storage →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Introduction to Defender for Storage malware scanning →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

Official Microsoft Learn documentation →