Azure Storage built-in role

Storage Account Key Operator Service Role

Lists and regenerates access keys on Azure Resource Manager storage accounts. The role has no DataActions, but anyone who obtains an account key can authorize requests to all account data through Shared Key and can sign service or account SAS tokens.

Control-plane actions (2)

• Microsoft.Storage/storageAccounts/listkeys/action
• Microsoft.Storage/storageAccounts/regeneratekey/action

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The role is assignable throughout the Azure hierarchy. Assign it on an individual storage account whenever possible; resource-group or subscription scope grants key operations on every inheriting account. Its authority is key management, not granular Microsoft Entra data access.

Common use cases (2)

• Run controlled account-key rotation automation for a storage account that still permits Shared Key.
• Retrieve a key for a documented legacy integration that cannot use Microsoft Entra authorization.

Prerequisites (3)

• Inventory all applications, connection strings, Azure services, and SAS tokens that depend on each account key.
• Confirm Shared Key is still required and enabled for the target account.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the storage-account scope.

Best practices (3)

• Assign to a dedicated rotation identity at one storage account and remove access after the task.
• Use Azure Key Vault or another approved secret-management process, rotate one key at a time, and regularly rotate both keys.
• Prefer Microsoft Entra authorization and disallow Shared Key after dependent clients are migrated.

Security considerations (3)

• Listing a key exposes all account data through Shared Key outside granular Azure RBAC data-role enforcement.
• Regeneration can interrupt every client using the key and invalidates service or account SAS tokens signed with it.
• The service-role name does not reduce the privilege of direct human assignment; key access must be tightly controlled and monitored.

Assignment guidance

Assign Storage Account Key Operator Service Role only to controlled rotation or compatibility automation, scoped to one storage account. Protect key material, coordinate a two-key rotation, monitor Shared Key usage, and remove the assignment when the operation completes.

Editorial sources (7)

• Azure built-in roles for Storage →

  Supports: Description, Practical scope, Common use cases. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Authorize operations for data access in Azure Storage →

  Supports: Description. Retrieved 2026-07-16.

• Prevent authorization with Shared Key →

  Supports: Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• Manage account access keys →

  Supports: Description, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• Grant limited access to data with shared access signatures →

  Supports: Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →