Azure Storage built-in role
Elastic SAN Owner
Provides full control-plane access to all resources under Azure Elastic SAN, including SANs, volume groups, volumes, and network security policies that can unblock data-path access. It has no DataActions, but it can materially change who can reach iSCSI volumes.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 80dcbedb-47ef-405d-95bd-188a1b4ac406
Control-plane actions (6)
Microsoft.Authorization/*/readMicrosoft.ResourceHealth/availabilityStatuses/readMicrosoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.ElasticSan/elasticSans/*Microsoft.ElasticSan/locations/*
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
The role is assignable throughout the Azure hierarchy. An assignment on a SAN or parent scope covers every Elastic SAN resource beneath it. Its wildcard Microsoft.ElasticSan Actions are management-plane permissions; actual client volume I/O still uses the configured iSCSI and network path.
Common use cases (2)
- Administer the full lifecycle of an Elastic SAN and all volume groups and volumes under it.
- Change SAN and volume-group network security policies as part of an approved storage-platform operation.
Prerequisites (3)
- Define the SAN, volume groups, capacity, network endpoint model, and authorized client subnets before granting full control.
- Confirm that a volume-group-scoped administrator or network-only role is insufficient.
- The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the SAN scope.
Best practices (3)
- Limit this role to the storage platform team and the individual SAN whenever possible.
- Use volume groups to isolate workloads and delegate narrower administration rather than granting SAN-wide control.
- Prefer private endpoints, disable public access when not required, and review network-policy changes as data-exposure changes.
Security considerations (3)
- The role can create, modify, or delete all Elastic SAN resources in scope and change network security policies that unblock data-path access.
- Deleting or reconfiguring SAN resources can disrupt or destroy storage presented to connected workloads.
- The absence of DataActions does not make the role low risk because its control-plane authority governs capacity, volumes, and network reachability.
Assignment guidance
Assign Elastic SAN Owner only to administrators who need complete SAN lifecycle and network-policy control, scoped to one SAN. Use narrower volume-group or network administration where the task does not require SAN-wide changes.
Common questions
When should I assign the Elastic SAN Owner Azure role?
Assign Elastic SAN Owner when you need to: Administer the full lifecycle of an Elastic SAN and all volume groups and volumes under it.; and Change SAN and volume-group network security policies as part of an approved storage-platform operation.. Practical scope: The role is assignable throughout the Azure hierarchy. An assignment on a SAN or parent scope covers every Elastic SAN resource beneath it. Its wildcard Microsoft.ElasticSan Actions are management-plane permissions; actual client volume I/O still uses the configured iSCSI and network path.
What permissions does the Elastic SAN Owner Azure role grant?
The role definition grants 6 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.ResourceHealth/availabilityStatuses/read; Microsoft.Resources/deployments/*; Microsoft.Resources/subscriptions/resourceGroups/read; Microsoft.ElasticSan/elasticSans/*; and Microsoft.ElasticSan/locations/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Elastic SAN Owner Azure role?
Key considerations when assigning Elastic SAN Owner: The role can create, modify, or delete all Elastic SAN resources in scope and change network security policies that unblock data-path access.; Deleting or reconfiguring SAN resources can disrupt or destroy storage presented to connected workloads.; and The absence of DataActions does not make the role low risk because its control-plane authority governs capacity, volumes, and network reachability.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for Storage →
Supports: Description, Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-16.
- Azure Elastic SAN networking concepts →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.