Azure Compute built-in role
Disk Backup Reader
Allows an Azure Backup vault managed identity to read a managed disk and obtain the disk access URI needed for Azure Disk Backup. Despite the word Reader, this is a backup service role and is not intended as a general human disk-inspection role.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 3e5e47e6-65f7-47ef-90b5-e5dd4d455f24
Control-plane actions (3)
Microsoft.Authorization/*/readMicrosoft.Compute/disks/readMicrosoft.Compute/disks/beginGetAccess/action
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign the role to the Backup vault managed identity on each source disk being protected, or at a resource group or subscription only when the vault should inherit access to multiple disks there. Its permissions are control-plane Actions and it has no DataActions.
Common use cases (2)
- Allow a Backup vault to validate and configure protection for an Azure managed disk.
- Permit scheduled and on-demand Azure Disk Backup to obtain access to an approved source disk.
Prerequisites (2)
- Create a Backup vault with its managed identity enabled and keep the vault and source disk in the same region.
- Assign Disk Snapshot Contributor to the same vault identity on the dedicated snapshot resource group used by the backup instance.
Best practices (3)
- Assign directly on each protected disk unless the vault intentionally protects every disk in a broader resource group.
- Use a dedicated snapshot resource group to isolate backup snapshots and their permissions.
- Review the vault identity assignments when protection is stopped or the disk is retired.
Security considerations (3)
- The beginGetAccess operation enables Azure Backup to obtain a disk access URI even though the role has no DataActions.
- Grant the role to the Backup vault managed identity, not to human backup operators who only manage the vault workflow.
- A broad inherited assignment lets the vault access every disk below the selected scope.
Assignment guidance
Assign Disk Backup Reader to the Backup vault managed identity on the source disk. Use a broader resource-group or subscription scope only for an explicitly approved multi-disk protection boundary, and pair it with Disk Snapshot Contributor on the dedicated snapshot resource group.
Related roles (1)
- Disk Snapshot Contributor: Microsoft documents this companion assignment for the same Backup vault managed identity on the snapshot resource group.
Common questions
When should I assign the Disk Backup Reader Azure role?
Assign Disk Backup Reader when you need to: Allow a Backup vault to validate and configure protection for an Azure managed disk.; and Permit scheduled and on-demand Azure Disk Backup to obtain access to an approved source disk.. Practical scope: Assign the role to the Backup vault managed identity on each source disk being protected, or at a resource group or subscription only when the vault should inherit access to multiple disks there. Its permissions are control-plane Actions and it has no DataActions.
What permissions does the Disk Backup Reader Azure role grant?
The role definition grants 3 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Compute/disks/read; and Microsoft.Compute/disks/beginGetAccess/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Disk Backup Reader Azure role?
Key considerations when assigning Disk Backup Reader: The beginGetAccess operation enables Azure Backup to obtain a disk access URI even though the role has no DataActions.; Grant the role to the Backup vault managed identity, not to human backup operators who only manage the vault workflow.; and A broad inherited assignment lets the vault access every disk below the selected scope.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Compute →
Supports: Description, Practical scope. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Back up Azure managed disks →
Supports: Description, Practical scope, Common use cases, Prerequisites, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Frequently asked questions about Azure Disk Backup →
Supports: Best practices, Security considerations. Retrieved 2026-07-16.