Azure Storage built-in role
Defender for Storage Data Scanner
Is the service role used by the system-assigned managed identity of the Defender for Storage StorageDataScanner resource. It reads blobs, reads Azure Files through privileged backup semantics that bypass file ACLs, reads and writes blob index tags, and includes blob deletion for supported remediation; it is not a general security-analyst role.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 1e7ca9b1-60d1-4db8-a914-f2ca1ff27c40
Control-plane actions (3)
Microsoft.Storage/storageAccounts/blobServices/containers/readMicrosoft.Storage/storageAccounts/blobServices/readMicrosoft.Storage/storageAccounts/fileServices/shares/read
Data-plane actions (6)
Microsoft.Storage/storageAccounts/blobServices/containers/blobs/readMicrosoft.Storage/storageAccounts/blobServices/containers/blobs/tags/writeMicrosoft.Storage/storageAccounts/blobServices/containers/blobs/tags/readMicrosoft.Storage/storageAccounts/blobServices/containers/blobs/deleteMicrosoft.Storage/storageAccounts/fileServices/fileshares/files/readMicrosoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Microsoft Defender for Storage creates the StorageDataScanner resource in the subscription and assigns this role so the scanner can reach protected storage data. Scope should be limited to the storage accounts being scanned; the role contains both management-plane listing Actions and direct blob/file DataActions.
Common use cases (2)
- Allow the Defender for Storage managed scanner to read content for on-upload or on-demand malware scanning.
- Let the scanning service write scan-result index tags and perform configured malicious-blob remediation.
Prerequisites (3)
- Defender for Storage and the selected malware-scanning mode must be enabled for the subscription or storage account.
- The Microsoft.EventGrid provider and automatically deployed scanning resources must remain intact for on-upload scanning.
- Assign this role to the StorageDataScanner managed identity, not to a human user.
Best practices (3)
- Let Defender for Storage create and maintain the scanner identity and its required assignment.
- Do not delete or manually repurpose the StorageDataScanner resource; re-enable the feature to repair missing resources or permissions.
- Use scan-result alerts, Event Grid, or Log Analytics for security-sensitive workflows because blob index tags are not tamper-resistant.
Security considerations (3)
- The scanner identity can read protected blob contents, bypass Azure Files ACLs through read backup semantics, update blob tags, and delete blobs.
- Changing or broadening the assignment exposes more storage data to the scanning identity, while removing it can stop malware scanning or remediation.
- Scan results in blob index tags can be altered by other principals with tag-write permission and should not be the sole security control.
Assignment guidance
Use this role only for the Defender-created StorageDataScanner managed identity and only on storage accounts covered by the scanning configuration. Preserve the managed service resources and verify scanning health after any authorization or network change.
Common questions
When should I assign the Defender for Storage Data Scanner Azure role?
Assign Defender for Storage Data Scanner when you need to: Allow the Defender for Storage managed scanner to read content for on-upload or on-demand malware scanning.; and Let the scanning service write scan-result index tags and perform configured malicious-blob remediation.. Practical scope: Microsoft Defender for Storage creates the StorageDataScanner resource in the subscription and assigns this role so the scanner can reach protected storage data. Scope should be limited to the storage accounts being scanned; the role contains both management-plane listing Actions and direct blob/file DataActions.
What permissions does the Defender for Storage Data Scanner Azure role grant?
The role definition grants 9 combined control-plane and data-plane actions. Representative operations include: Microsoft.Storage/storageAccounts/blobServices/containers/read; Microsoft.Storage/storageAccounts/blobServices/read; Microsoft.Storage/storageAccounts/fileServices/shares/read; Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read; Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/write; and Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Defender for Storage Data Scanner Azure role?
Key considerations when assigning Defender for Storage Data Scanner: The scanner identity can read protected blob contents, bypass Azure Files ACLs through read backup semantics, update blob tags, and delete blobs.; Changing or broadening the assignment exposes more storage data to the scanning identity, while removing it can stop malware scanning or remediation.; and Scan results in blob index tags can be altered by other principals with tag-write permission and should not be the sole security control.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (3)
- Azure built-in roles for Storage →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Introduction to Defender for Storage malware scanning →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.