Azure Storage built-in role

Reader and Data Access

Reads storage-account control-plane information and can list account keys and create an account SAS. It has no DataActions, but the account key enables read and write access to all data in the storage account through Shared Key authorization.

Control-plane actions (3)

• Microsoft.Storage/storageAccounts/listKeys/action
• Microsoft.Storage/storageAccounts/ListAccountSas/action
• Microsoft.Storage/storageAccounts/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The role is assignable throughout the Azure hierarchy. An assignment at a storage account exposes that account's keys and data; a resource-group or subscription assignment is inherited by every storage account below it. Shared Key access is account-wide rather than constrained by Blob, Queue, Table, or File data-role assignments.

Common use cases (2)

• Support a documented Azure File Sync cloud-endpoint workflow that still requires listKeys and account-SAS permissions.
• Operate a legacy tool that must view the account and access its data through an account key when Microsoft Entra authorization is unavailable.

Prerequisites (3)

• Verify that the workflow genuinely requires account-key or account-SAS access and cannot use a service-specific data role with Microsoft Entra ID.
• Confirm Shared Key authorization is enabled for the target account and assess every service in that account.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the storage-account scope.

Best practices (3)

• Prefer Microsoft Entra data roles and managed identities; use this role only for a documented compatibility requirement.
• Assign on one storage account, protect retrieved keys as credentials, and remove the assignment after the operation.
• Monitor Shared Key and SAS use, migrate dependent clients, and disallow Shared Key when compatibility permits.

Security considerations (3)

• Listing an account key bypasses granular Azure RBAC data-plane boundaries and can expose all blob, file, queue, and table data in the account.
• Account SAS generation can delegate broad service and data operations, and SAS creation is not directly audited by Azure Storage.
• Disabling Shared Key blocks account-key and account-SAS requests but can break services such as documented Azure File Sync configurations.

Assignment guidance

Do not treat Reader and Data Access as a normal reader. Assign it only at an individual storage account for a workflow that explicitly requires keys or an account SAS, prefer a managed automation identity, monitor key use, and remove access when the compatibility need ends.

Related roles (1)

• Azure File Sync Administrator: Microsoft explicitly documents Reader and Data Access as one storage-account role used with Azure File Sync cloud-endpoint operations.

Editorial sources (9)

• Azure built-in roles for Storage →

  Supports: Description, Practical scope, Common use cases, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Authorize operations for data access in Azure Storage →

  Supports: Description, Best practices. Retrieved 2026-07-16.

• Prevent authorization with Shared Key →

  Supports: Practical scope, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• Manage account access keys →

  Supports: Description, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• Grant limited access to data with shared access signatures →

  Supports: Security considerations. Retrieved 2026-07-16.

• Deploy Azure File Sync →

  Supports: Common use cases, Prerequisites, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →