Azure Storage built-in role

Elastic SAN Volume Group Owner

Provides full control-plane access to an Elastic SAN volume group, including its volumes and network security policies that can unblock data-path access. It does not grant full SAN-wide lifecycle authority and has no DataActions.

Control-plane actions (4)

• Microsoft.Authorization/roleAssignments/read
• Microsoft.Authorization/roleDefinitions/read
• Microsoft.ElasticSan/elasticSans/volumeGroups/*
• Microsoft.ElasticSan/locations/asyncoperations/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The role is assignable throughout the Azure hierarchy, but its Microsoft.ElasticSan permissions are limited to volume-group resources. Assign it on the target volume group so its wildcard does not extend to every volume group under a SAN through a broader parent scope.

Common use cases (2)

• Delegate lifecycle management of one workload's Elastic SAN volume group and its volumes.
• Let a workload storage administrator maintain the volume group's network security policies without granting control of the entire SAN.

Prerequisites (3)

• Create or identify the volume group that forms the workload isolation and network-policy boundary.
• Define the authorized endpoints, virtual networks, subnets, and iSCSI clients for volumes in the group.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the volume-group scope.

Best practices (3)

• Assign directly on one volume group and keep SAN-wide administration with the storage platform team.
• Review all network-rule changes because every volume in the group inherits the volume-group network configuration.
• Prefer private endpoints and disable public network access at the SAN when service endpoints are not required.

Security considerations (3)

• The role can create, modify, and delete volume-group resources and alter policies that permit data-path access to all volumes in the group.
• Every volume inherits the group's network configuration, so one change can expose or disconnect the entire workload set.
• No DataActions are present, but control of volumes and their network boundary remains highly privileged.

Assignment guidance

Assign Elastic SAN Volume Group Owner to the administrator of one approved workload boundary, directly on that volume group. Keep SAN-wide control separate and require review for network-policy or destructive volume changes.

Editorial sources (5)

• Azure built-in roles for Storage →

  Supports: Description, Practical scope, Common use cases, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Azure Elastic SAN networking concepts →

  Supports: Description, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

Official Microsoft Learn documentation →