Azure Compute built-in role

Disk Restore Operator

Allows an Azure Backup vault managed identity to read and create managed disks and to begin or end disk access during an Azure Disk Backup restore. It is a restore service role for a target resource group, not a human Backup Operator role.

Control-plane actions (6)

• Microsoft.Authorization/*/read
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Compute/disks/write
• Microsoft.Compute/disks/read
• Microsoft.Compute/disks/beginGetAccess/action
• Microsoft.Compute/disks/endGetAccess/action

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign the role to the Backup vault managed identity on the target resource group where restored disks will be created. The assignment is inherited by disks in that group. Its permissions are control-plane Actions only and include disk access-URI operations; it has no DataActions.

Common use cases (2)

• Validate and restore a new managed disk from an Azure Disk Backup recovery point into an approved target resource group.
• Support alternate-location or cross-subscription disk restore where the target group and vault settings meet the documented requirements.

Prerequisites (2)

• The Backup vault managed identity must exist and the selected recovery point, target subscription, target resource group, region, and disk name must be valid.
• The operator initiating the workflow also needs Backup Operator on the Backup vault; that human role is separate from this service assignment.

Best practices (3)

• Grant the role on a dedicated target resource group for the restore operation.
• Validate the restored disk before attaching it or swapping an OS disk.
• Follow Microsoft guidance to revoke Disk Restore Operator from the vault managed identity after a successful restore when ongoing access is unnecessary.

Security considerations (3)

• The vault identity can create or update disks and obtain and revoke disk access URIs throughout the target resource group.
• Restored disks contain protected workload data and must inherit appropriate encryption, network-access, and downstream RBAC controls before use.
• The role has no DataActions, but disk creation and SAS-style access operations remain privileged.

Assignment guidance

Assign Disk Restore Operator to the Backup vault managed identity on the target resource group immediately before validation or restore. Keep Backup Operator on the human or automation initiating the vault workflow, and remove the service assignment after successful restore when it is no longer needed.

Related roles (1)

• Backup Operator: Microsoft documents Backup Operator on the Backup vault for the principal that initiates validation and restore, while Disk Restore Operator belongs to the vault managed identity on the target resource group.

Editorial sources (7)

• Azure built-in roles for Compute →

  Supports: Description, Practical scope. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Restore Azure managed disks →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• Frequently asked questions about Azure Disk Backup →

  Supports: Best practices, Security considerations. Retrieved 2026-07-16.

• Manage backups with Azure role-based access control →

  Supports: Prerequisites, Assignment guidance, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →