Azure Compute built-in role
Disk Snapshot Contributor
Allows an Azure Backup vault managed identity to create, read, update, and delete snapshots in the snapshot resource group used by Azure Disk Backup. The definition also manages temporary storage accounts, lists storage keys, and performs disk and snapshot access-URI operations.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 7efff54f-a5b4-42b5-a1c5-5411624893ce
Control-plane actions (12)
Microsoft.Authorization/*/readMicrosoft.Resources/subscriptions/resourceGroups/readMicrosoft.Compute/snapshots/deleteMicrosoft.Compute/snapshots/writeMicrosoft.Compute/snapshots/readMicrosoft.Compute/snapshots/beginGetAccess/actionMicrosoft.Compute/snapshots/endGetAccess/actionMicrosoft.Compute/disks/beginGetAccess/actionMicrosoft.Storage/storageAccounts/listkeys/actionMicrosoft.Storage/storageAccounts/writeMicrosoft.Storage/storageAccounts/readMicrosoft.Storage/storageAccounts/delete
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign the role to the Backup vault managed identity on the dedicated snapshot resource group selected for the disk backup instance. The role is inherited by every snapshot and storage account in that group. It uses control-plane Actions only and has no DataActions.
Common use cases (2)
- Allow Azure Disk Backup to create and retain incremental snapshots for scheduled or on-demand disk backups.
- Permit the vault service to manage snapshot lifecycle and the supporting access operations in its snapshot datastore resource group.
Prerequisites (2)
- Create a dedicated snapshot resource group in the same subscription as the source disk and select it when configuring protection.
- Assign Disk Backup Reader to the same Backup vault managed identity on each source disk.
Best practices (3)
- Use a dedicated snapshot resource group so the role does not cover unrelated snapshots or storage accounts.
- Do not move or delete protected incremental snapshots or revoke required assignments while the backup instance depends on them.
- Review snapshot retention, the 500-snapshot disk limit, and the vault identity assignments periodically.
Security considerations (3)
- The role can delete backup snapshots and storage accounts in scope and can list storage account keys.
- Deleting or moving snapshots or removing the assignment can cause backup or restore failures.
- Although it has no DataActions, storage keys and snapshot access URIs can expose protected data outside ordinary Azure RBAC data-plane checks.
Assignment guidance
Assign Disk Snapshot Contributor to the Backup vault managed identity on the dedicated snapshot resource group only. Pair it with Disk Backup Reader on source disks, keep unrelated resources out of the group, and remove the assignment only after dependent backup instances and snapshots are retired.
Related roles (1)
- Disk Backup Reader: Microsoft documents this companion assignment for the same Backup vault managed identity on each source disk.
Common questions
When should I assign the Disk Snapshot Contributor Azure role?
Assign Disk Snapshot Contributor when you need to: Allow Azure Disk Backup to create and retain incremental snapshots for scheduled or on-demand disk backups.; and Permit the vault service to manage snapshot lifecycle and the supporting access operations in its snapshot datastore resource group.. Practical scope: Assign the role to the Backup vault managed identity on the dedicated snapshot resource group selected for the disk backup instance. The role is inherited by every snapshot and storage account in that group. It uses control-plane Actions only and has no DataActions.
What permissions does the Disk Snapshot Contributor Azure role grant?
The role definition grants 12 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Resources/subscriptions/resourceGroups/read; Microsoft.Compute/snapshots/delete; Microsoft.Compute/snapshots/write; Microsoft.Compute/snapshots/read; and Microsoft.Compute/snapshots/beginGetAccess/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Disk Snapshot Contributor Azure role?
Key considerations when assigning Disk Snapshot Contributor: The role can delete backup snapshots and storage accounts in scope and can list storage account keys.; Deleting or moving snapshots or removing the assignment can cause backup or restore failures.; and Although it has no DataActions, storage keys and snapshot access URIs can expose protected data outside ordinary Azure RBAC data-plane checks.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Compute →
Supports: Description, Practical scope. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Back up Azure managed disks →
Supports: Description, Practical scope, Common use cases, Prerequisites, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Frequently asked questions about Azure Disk Backup →
Supports: Best practices, Security considerations. Retrieved 2026-07-16.