Azure Storage built-in role

Elastic SAN Owner

Provides full control-plane access to all resources under Azure Elastic SAN, including SANs, volume groups, volumes, and network security policies that can unblock data-path access. It has no DataActions, but it can materially change who can reach iSCSI volumes.

Control-plane actions (6)

• Microsoft.Authorization/*/read
• Microsoft.ResourceHealth/availabilityStatuses/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.ElasticSan/elasticSans/*
• Microsoft.ElasticSan/locations/*

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The role is assignable throughout the Azure hierarchy. An assignment on a SAN or parent scope covers every Elastic SAN resource beneath it. Its wildcard Microsoft.ElasticSan Actions are management-plane permissions; actual client volume I/O still uses the configured iSCSI and network path.

Common use cases (2)

• Administer the full lifecycle of an Elastic SAN and all volume groups and volumes under it.
• Change SAN and volume-group network security policies as part of an approved storage-platform operation.

Prerequisites (3)

• Define the SAN, volume groups, capacity, network endpoint model, and authorized client subnets before granting full control.
• Confirm that a volume-group-scoped administrator or network-only role is insufficient.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the SAN scope.

Best practices (3)

• Limit this role to the storage platform team and the individual SAN whenever possible.
• Use volume groups to isolate workloads and delegate narrower administration rather than granting SAN-wide control.
• Prefer private endpoints, disable public access when not required, and review network-policy changes as data-exposure changes.

Security considerations (3)

• The role can create, modify, or delete all Elastic SAN resources in scope and change network security policies that unblock data-path access.
• Deleting or reconfiguring SAN resources can disrupt or destroy storage presented to connected workloads.
• The absence of DataActions does not make the role low risk because its control-plane authority governs capacity, volumes, and network reachability.

Assignment guidance

Assign Elastic SAN Owner only to administrators who need complete SAN lifecycle and network-policy control, scoped to one SAN. Use narrower volume-group or network administration where the task does not require SAN-wide changes.

Editorial sources (5)

• Azure built-in roles for Storage →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Azure Elastic SAN networking concepts →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

Official Microsoft Learn documentation →