Azure Storage built-in role

Storage Account Contributor

Creates and manages Azure Resource Manager storage accounts and related configuration. It has no DataActions and therefore does not grant data access through Microsoft Entra authorization, but it includes access to account keys, which can be used for full account data access through Shared Key.

Control-plane actions (9)

• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Insights/diagnosticSettings/*
• Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action
• Microsoft.ResourceHealth/availabilityStatuses/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Storage/storageAccounts/*
• Microsoft.Support/*

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The role is assignable throughout the Azure hierarchy. A storage-account assignment manages one account; a resource-group or subscription assignment is inherited by all child accounts. Its storageAccounts wildcard is control-plane authority, while key retrieval opens a separate account-wide Shared Key data path.

Common use cases (2)

• Create, configure, network, monitor, or delete storage accounts without granting Azure RBAC role-assignment authority.
• Perform a documented Azure Backup or Azure File Sync workflow that requires storage-account management and key operations.

Prerequisites (3)

• Confirm that the principal needs storage-account lifecycle management rather than only a service-specific data role.
• Assess whether Shared Key can be disabled and whether any workflow actually requires listKeys.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target scope.

Best practices (3)

• Assign on the individual storage account or dedicated resource group and prefer service-specific management roles when available.
• Use Microsoft Entra data roles and managed identities for blob, queue, and table data rather than account keys.
• Monitor key use and disallow Shared Key after dependent applications and Azure services have migrated to supported identity-based authorization.

Security considerations (3)

• The role can change or delete storage accounts and alter networking, authorization, and data-protection configuration.
• Although it has no DataActions, listKeys access can expose all data in the account through Shared Key and can generate account or service SAS tokens.
• A broad scope places every inheriting storage account and its keys under the assignee's control.

Assignment guidance

Use Storage Account Contributor only for storage-account lifecycle administrators and scope it to the accounts they manage. Do not describe it as data-plane least privilege: prefer service-specific data roles, review its account-key access, and remove or constrain Shared Key wherever compatibility permits.

Editorial sources (10)

• Azure built-in roles for Storage →

  Supports: Description, Practical scope, Common use cases, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Authorize operations for data access in Azure Storage →

  Supports: Best practices. Retrieved 2026-07-16.

• Authorize Blob Storage access with Microsoft Entra ID →

  Supports: Description, Assignment guidance. Retrieved 2026-07-16.

• Prevent authorization with Shared Key →

  Supports: Description, Practical scope, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• Manage account access keys →

  Supports: Security considerations. Retrieved 2026-07-16.

• Manage backups with Azure role-based access control →

  Supports: Common use cases. Retrieved 2026-07-16.

• Deploy Azure File Sync →

  Supports: Common use cases. Retrieved 2026-07-16.

Official Microsoft Learn documentation →