Azure Storage built-in role
Reader and Data Access
Reads storage-account control-plane information and can list account keys and create an account SAS. It has no DataActions, but the account key enables read and write access to all data in the storage account through Shared Key authorization.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: c12c1c16-33a1-487b-954d-41c89c60f349
Control-plane actions (3)
Microsoft.Storage/storageAccounts/listKeys/actionMicrosoft.Storage/storageAccounts/ListAccountSas/actionMicrosoft.Storage/storageAccounts/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
The role is assignable throughout the Azure hierarchy. An assignment at a storage account exposes that account's keys and data; a resource-group or subscription assignment is inherited by every storage account below it. Shared Key access is account-wide rather than constrained by Blob, Queue, Table, or File data-role assignments.
Common use cases (2)
- Support a documented Azure File Sync cloud-endpoint workflow that still requires listKeys and account-SAS permissions.
- Operate a legacy tool that must view the account and access its data through an account key when Microsoft Entra authorization is unavailable.
Prerequisites (3)
- Verify that the workflow genuinely requires account-key or account-SAS access and cannot use a service-specific data role with Microsoft Entra ID.
- Confirm Shared Key authorization is enabled for the target account and assess every service in that account.
- The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the storage-account scope.
Best practices (3)
- Prefer Microsoft Entra data roles and managed identities; use this role only for a documented compatibility requirement.
- Assign on one storage account, protect retrieved keys as credentials, and remove the assignment after the operation.
- Monitor Shared Key and SAS use, migrate dependent clients, and disallow Shared Key when compatibility permits.
Security considerations (3)
- Listing an account key bypasses granular Azure RBAC data-plane boundaries and can expose all blob, file, queue, and table data in the account.
- Account SAS generation can delegate broad service and data operations, and SAS creation is not directly audited by Azure Storage.
- Disabling Shared Key blocks account-key and account-SAS requests but can break services such as documented Azure File Sync configurations.
Assignment guidance
Do not treat Reader and Data Access as a normal reader. Assign it only at an individual storage account for a workflow that explicitly requires keys or an account SAS, prefer a managed automation identity, monitor key use, and remove access when the compatibility need ends.
Related roles (1)
- Azure File Sync Administrator: Microsoft explicitly documents Reader and Data Access as one storage-account role used with Azure File Sync cloud-endpoint operations.
Common questions
When should I assign the Reader and Data Access Azure role?
Assign Reader and Data Access when you need to: Support a documented Azure File Sync cloud-endpoint workflow that still requires listKeys and account-SAS permissions.; and Operate a legacy tool that must view the account and access its data through an account key when Microsoft Entra authorization is unavailable.. Practical scope: The role is assignable throughout the Azure hierarchy. An assignment at a storage account exposes that account's keys and data; a resource-group or subscription assignment is inherited by every storage account below it. Shared Key access is account-wide rather than constrained by Blob, Queue, Table, or File data-role assignments.
What permissions does the Reader and Data Access Azure role grant?
The role definition grants 3 combined control-plane and data-plane actions. Representative operations include: Microsoft.Storage/storageAccounts/listKeys/action; Microsoft.Storage/storageAccounts/ListAccountSas/action; and Microsoft.Storage/storageAccounts/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Reader and Data Access Azure role?
Key considerations when assigning Reader and Data Access: Listing an account key bypasses granular Azure RBAC data-plane boundaries and can expose all blob, file, queue, and table data in the account.; Account SAS generation can delegate broad service and data operations, and SAS creation is not directly audited by Azure Storage.; and Disabling Shared Key blocks account-key and account-SAS requests but can break services such as documented Azure File Sync configurations.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (9)
- Azure built-in roles for Storage →
Supports: Description, Practical scope, Common use cases, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-16.
- Authorize operations for data access in Azure Storage →
Supports: Description, Best practices. Retrieved 2026-07-16.
- Prevent authorization with Shared Key →
Supports: Practical scope, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.
- Manage account access keys →
Supports: Description, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.
- Grant limited access to data with shared access signatures →
Supports: Security considerations. Retrieved 2026-07-16.
- Deploy Azure File Sync →
Supports: Common use cases, Prerequisites, Related roles. Retrieved 2026-07-16.