Azure Storage built-in role
Storage Account Contributor
Creates and manages Azure Resource Manager storage accounts and related configuration. It has no DataActions and therefore does not grant data access through Microsoft Entra authorization, but it includes access to account keys, which can be used for full account data access through Shared Key.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 17d1049b-9a84-46fb-8f53-869881c3d3ab
Control-plane actions (9)
Microsoft.Authorization/*/readMicrosoft.Insights/alertRules/*Microsoft.Insights/diagnosticSettings/*Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/actionMicrosoft.ResourceHealth/availabilityStatuses/readMicrosoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.Storage/storageAccounts/*Microsoft.Support/*
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
The role is assignable throughout the Azure hierarchy. A storage-account assignment manages one account; a resource-group or subscription assignment is inherited by all child accounts. Its storageAccounts wildcard is control-plane authority, while key retrieval opens a separate account-wide Shared Key data path.
Common use cases (2)
- Create, configure, network, monitor, or delete storage accounts without granting Azure RBAC role-assignment authority.
- Perform a documented Azure Backup or Azure File Sync workflow that requires storage-account management and key operations.
Prerequisites (3)
- Confirm that the principal needs storage-account lifecycle management rather than only a service-specific data role.
- Assess whether Shared Key can be disabled and whether any workflow actually requires listKeys.
- The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target scope.
Best practices (3)
- Assign on the individual storage account or dedicated resource group and prefer service-specific management roles when available.
- Use Microsoft Entra data roles and managed identities for blob, queue, and table data rather than account keys.
- Monitor key use and disallow Shared Key after dependent applications and Azure services have migrated to supported identity-based authorization.
Security considerations (3)
- The role can change or delete storage accounts and alter networking, authorization, and data-protection configuration.
- Although it has no DataActions, listKeys access can expose all data in the account through Shared Key and can generate account or service SAS tokens.
- A broad scope places every inheriting storage account and its keys under the assignee's control.
Assignment guidance
Use Storage Account Contributor only for storage-account lifecycle administrators and scope it to the accounts they manage. Do not describe it as data-plane least privilege: prefer service-specific data roles, review its account-key access, and remove or constrain Shared Key wherever compatibility permits.
Common questions
When should I assign the Storage Account Contributor Azure role?
Assign Storage Account Contributor when you need to: Create, configure, network, monitor, or delete storage accounts without granting Azure RBAC role-assignment authority.; and Perform a documented Azure Backup or Azure File Sync workflow that requires storage-account management and key operations.. Practical scope: The role is assignable throughout the Azure hierarchy. A storage-account assignment manages one account; a resource-group or subscription assignment is inherited by all child accounts. Its storageAccounts wildcard is control-plane authority, while key retrieval opens a separate account-wide Shared Key data path.
What permissions does the Storage Account Contributor Azure role grant?
The role definition grants 9 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; Microsoft.Insights/diagnosticSettings/*; Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action; Microsoft.ResourceHealth/availabilityStatuses/read; and Microsoft.Resources/deployments/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Storage Account Contributor Azure role?
Key considerations when assigning Storage Account Contributor: The role can change or delete storage accounts and alter networking, authorization, and data-protection configuration.; Although it has no DataActions, listKeys access can expose all data in the account through Shared Key and can generate account or service SAS tokens.; and A broad scope places every inheriting storage account and its keys under the assignee's control.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (10)
- Azure built-in roles for Storage →
Supports: Description, Practical scope, Common use cases, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-16.
- Authorize operations for data access in Azure Storage →
Supports: Best practices. Retrieved 2026-07-16.
- Authorize Blob Storage access with Microsoft Entra ID →
Supports: Description, Assignment guidance. Retrieved 2026-07-16.
- Prevent authorization with Shared Key →
Supports: Description, Practical scope, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.
- Manage account access keys →
Supports: Security considerations. Retrieved 2026-07-16.
- Manage backups with Azure role-based access control →
Supports: Common use cases. Retrieved 2026-07-16.
- Deploy Azure File Sync →
Supports: Common use cases. Retrieved 2026-07-16.