Azure Compute built-in role
Disk Restore Operator
Allows an Azure Backup vault managed identity to read and create managed disks and to begin or end disk access during an Azure Disk Backup restore. It is a restore service role for a target resource group, not a human Backup Operator role.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: b50d9833-a0cb-478e-945f-707fcc997c13
Control-plane actions (6)
Microsoft.Authorization/*/readMicrosoft.Resources/subscriptions/resourceGroups/readMicrosoft.Compute/disks/writeMicrosoft.Compute/disks/readMicrosoft.Compute/disks/beginGetAccess/actionMicrosoft.Compute/disks/endGetAccess/action
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign the role to the Backup vault managed identity on the target resource group where restored disks will be created. The assignment is inherited by disks in that group. Its permissions are control-plane Actions only and include disk access-URI operations; it has no DataActions.
Common use cases (2)
- Validate and restore a new managed disk from an Azure Disk Backup recovery point into an approved target resource group.
- Support alternate-location or cross-subscription disk restore where the target group and vault settings meet the documented requirements.
Prerequisites (2)
- The Backup vault managed identity must exist and the selected recovery point, target subscription, target resource group, region, and disk name must be valid.
- The operator initiating the workflow also needs Backup Operator on the Backup vault; that human role is separate from this service assignment.
Best practices (3)
- Grant the role on a dedicated target resource group for the restore operation.
- Validate the restored disk before attaching it or swapping an OS disk.
- Follow Microsoft guidance to revoke Disk Restore Operator from the vault managed identity after a successful restore when ongoing access is unnecessary.
Security considerations (3)
- The vault identity can create or update disks and obtain and revoke disk access URIs throughout the target resource group.
- Restored disks contain protected workload data and must inherit appropriate encryption, network-access, and downstream RBAC controls before use.
- The role has no DataActions, but disk creation and SAS-style access operations remain privileged.
Assignment guidance
Assign Disk Restore Operator to the Backup vault managed identity on the target resource group immediately before validation or restore. Keep Backup Operator on the human or automation initiating the vault workflow, and remove the service assignment after successful restore when it is no longer needed.
Related roles (1)
- Backup Operator: Microsoft documents Backup Operator on the Backup vault for the principal that initiates validation and restore, while Disk Restore Operator belongs to the vault managed identity on the target resource group.
Common questions
When should I assign the Disk Restore Operator Azure role?
Assign Disk Restore Operator when you need to: Validate and restore a new managed disk from an Azure Disk Backup recovery point into an approved target resource group.; and Support alternate-location or cross-subscription disk restore where the target group and vault settings meet the documented requirements.. Practical scope: Assign the role to the Backup vault managed identity on the target resource group where restored disks will be created. The assignment is inherited by disks in that group. Its permissions are control-plane Actions only and include disk access-URI operations; it has no DataActions.
What permissions does the Disk Restore Operator Azure role grant?
The role definition grants 6 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Resources/subscriptions/resourceGroups/read; Microsoft.Compute/disks/write; Microsoft.Compute/disks/read; Microsoft.Compute/disks/beginGetAccess/action; and Microsoft.Compute/disks/endGetAccess/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Disk Restore Operator Azure role?
Key considerations when assigning Disk Restore Operator: The vault identity can create or update disks and obtain and revoke disk access URIs throughout the target resource group.; Restored disks contain protected workload data and must inherit appropriate encryption, network-access, and downstream RBAC controls before use.; and The role has no DataActions, but disk creation and SAS-style access operations remain privileged.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Compute →
Supports: Description, Practical scope. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Restore Azure managed disks →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.
- Frequently asked questions about Azure Disk Backup →
Supports: Best practices, Security considerations. Retrieved 2026-07-16.
- Manage backups with Azure role-based access control →
Supports: Prerequisites, Assignment guidance, Related roles. Retrieved 2026-07-16.