Azure Storage built-in role

Storage Actions Blob Data Operator

Is the purpose-built data role for a Storage Actions storage task managed identity. It can list and create containers and read, add, write, delete, tag, undelete, and perform supported immutability or legal-hold operations on blobs; it is an execution role, not the role for authoring a storage task.

Control-plane actions (6)

• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Storage/storageAccounts/blobServices/containers/read
• Microsoft.Storage/storageAccounts/blobServices/containers/write

Data-plane actions (8)

• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read
• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write
• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete
• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action
• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/read
• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/write
• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/runAsSuperUser/action
• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/immutableStorage/runAsSuperUser/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The role is assignable throughout the Azure hierarchy, but Microsoft documents assigning it to the storage task managed identity on the target storage account or container. Its Actions cover required container management and its DataActions cover all currently supported Storage Actions blob operations, including superuser operations.

Common use cases (2)

• Let a storage task managed identity execute lifecycle operations such as tier, expiry, tag, delete, or undelete on selected blobs.
• Run a storage task that sets blob immutability policies or legal holds on an approved target scope.

Prerequisites (3)

• Create the storage task and its managed identity, then create a task assignment for the target storage account.
• Review every operation and condition in the task because this role covers all operations supported by Storage Actions.
• The task assigner needs Storage Actions Task Assignment Contributor or equivalent permissions to assign this role to the task identity.

Best practices (3)

• Assign this role to the storage task managed identity rather than to a human user.
• Scope it to the target container when the task does not need every container in the account.
• Use a custom role when the task needs a smaller operation set than this purpose-built role grants.

Security considerations (3)

• The role can read and alter blob contents, delete or undelete blobs, and change tags.
• Its superuser DataActions can set immutability policies and legal holds, so a task definition can affect retention and deletion controls.
• Microsoft documents this role as narrower than Storage Blob Data Owner for Storage Actions, but it remains a powerful service execution role.

Assignment guidance

Assign Storage Actions Blob Data Operator to the managed identity of the specific storage task on the narrowest target storage account or container. Review the task conditions and operations first, and use a tighter custom role when the task does not need the complete supported operation set.

Related roles (2)

• Storage Actions Task Assignment Contributor: Microsoft documents the assignment role as creating task assignments and granting this execution role to the task managed identity.
• Storage Blob Data Owner: Microsoft states that Blob Data Owner also covers Storage Actions operations but is broader than this purpose-built role.

Editorial sources (4)

• Azure built-in roles for Storage →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Azure roles required to assign storage tasks →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →