Azure Storage built-in role
Storage Account Key Operator Service Role
Lists and regenerates access keys on Azure Resource Manager storage accounts. The role has no DataActions, but anyone who obtains an account key can authorize requests to all account data through Shared Key and can sign service or account SAS tokens.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 81a9662b-bebf-436f-a333-f67b29880f12
Control-plane actions (2)
Microsoft.Storage/storageAccounts/listkeys/actionMicrosoft.Storage/storageAccounts/regeneratekey/action
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
The role is assignable throughout the Azure hierarchy. Assign it on an individual storage account whenever possible; resource-group or subscription scope grants key operations on every inheriting account. Its authority is key management, not granular Microsoft Entra data access.
Common use cases (2)
- Run controlled account-key rotation automation for a storage account that still permits Shared Key.
- Retrieve a key for a documented legacy integration that cannot use Microsoft Entra authorization.
Prerequisites (3)
- Inventory all applications, connection strings, Azure services, and SAS tokens that depend on each account key.
- Confirm Shared Key is still required and enabled for the target account.
- The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the storage-account scope.
Best practices (3)
- Assign to a dedicated rotation identity at one storage account and remove access after the task.
- Use Azure Key Vault or another approved secret-management process, rotate one key at a time, and regularly rotate both keys.
- Prefer Microsoft Entra authorization and disallow Shared Key after dependent clients are migrated.
Security considerations (3)
- Listing a key exposes all account data through Shared Key outside granular Azure RBAC data-role enforcement.
- Regeneration can interrupt every client using the key and invalidates service or account SAS tokens signed with it.
- The service-role name does not reduce the privilege of direct human assignment; key access must be tightly controlled and monitored.
Assignment guidance
Assign Storage Account Key Operator Service Role only to controlled rotation or compatibility automation, scoped to one storage account. Protect key material, coordinate a two-key rotation, monitor Shared Key usage, and remove the assignment when the operation completes.
Common questions
When should I assign the Storage Account Key Operator Service Role Azure role?
Assign Storage Account Key Operator Service Role when you need to: Run controlled account-key rotation automation for a storage account that still permits Shared Key.; and Retrieve a key for a documented legacy integration that cannot use Microsoft Entra authorization.. Practical scope: The role is assignable throughout the Azure hierarchy. Assign it on an individual storage account whenever possible; resource-group or subscription scope grants key operations on every inheriting account. Its authority is key management, not granular Microsoft Entra data access.
What permissions does the Storage Account Key Operator Service Role Azure role grant?
The role definition grants 2 combined control-plane and data-plane actions. Representative operations include: Microsoft.Storage/storageAccounts/listkeys/action; and Microsoft.Storage/storageAccounts/regeneratekey/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Storage Account Key Operator Service Role Azure role?
Key considerations when assigning Storage Account Key Operator Service Role: Listing a key exposes all account data through Shared Key outside granular Azure RBAC data-role enforcement.; Regeneration can interrupt every client using the key and invalidates service or account SAS tokens signed with it.; and The service-role name does not reduce the privilege of direct human assignment; key access must be tightly controlled and monitored.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Storage →
Supports: Description, Practical scope, Common use cases. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Authorize operations for data access in Azure Storage →
Supports: Description. Retrieved 2026-07-16.
- Prevent authorization with Shared Key →
Supports: Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.
- Manage account access keys →
Supports: Description, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.
- Grant limited access to data with shared access signatures →
Supports: Security considerations. Retrieved 2026-07-16.