Azure Storage built-in role
Storage Actions Blob Data Operator
Is the purpose-built data role for a Storage Actions storage task managed identity. It can list and create containers and read, add, write, delete, tag, undelete, and perform supported immutability or legal-hold operations on blobs; it is an execution role, not the role for authoring a storage task.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 4bad4d9e-2a13-4888-94bb-c8432f6f3040
Control-plane actions (6)
Microsoft.Authorization/*/readMicrosoft.Insights/alertRules/*Microsoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.Storage/storageAccounts/blobServices/containers/readMicrosoft.Storage/storageAccounts/blobServices/containers/write
Data-plane actions (8)
Microsoft.Storage/storageAccounts/blobServices/containers/blobs/readMicrosoft.Storage/storageAccounts/blobServices/containers/blobs/writeMicrosoft.Storage/storageAccounts/blobServices/containers/blobs/deleteMicrosoft.Storage/storageAccounts/blobServices/containers/blobs/add/actionMicrosoft.Storage/storageAccounts/blobServices/containers/blobs/tags/readMicrosoft.Storage/storageAccounts/blobServices/containers/blobs/tags/writeMicrosoft.Storage/storageAccounts/blobServices/containers/blobs/runAsSuperUser/actionMicrosoft.Storage/storageAccounts/blobServices/containers/blobs/immutableStorage/runAsSuperUser/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
The role is assignable throughout the Azure hierarchy, but Microsoft documents assigning it to the storage task managed identity on the target storage account or container. Its Actions cover required container management and its DataActions cover all currently supported Storage Actions blob operations, including superuser operations.
Common use cases (2)
- Let a storage task managed identity execute lifecycle operations such as tier, expiry, tag, delete, or undelete on selected blobs.
- Run a storage task that sets blob immutability policies or legal holds on an approved target scope.
Prerequisites (3)
- Create the storage task and its managed identity, then create a task assignment for the target storage account.
- Review every operation and condition in the task because this role covers all operations supported by Storage Actions.
- The task assigner needs Storage Actions Task Assignment Contributor or equivalent permissions to assign this role to the task identity.
Best practices (3)
- Assign this role to the storage task managed identity rather than to a human user.
- Scope it to the target container when the task does not need every container in the account.
- Use a custom role when the task needs a smaller operation set than this purpose-built role grants.
Security considerations (3)
- The role can read and alter blob contents, delete or undelete blobs, and change tags.
- Its superuser DataActions can set immutability policies and legal holds, so a task definition can affect retention and deletion controls.
- Microsoft documents this role as narrower than Storage Blob Data Owner for Storage Actions, but it remains a powerful service execution role.
Assignment guidance
Assign Storage Actions Blob Data Operator to the managed identity of the specific storage task on the narrowest target storage account or container. Review the task conditions and operations first, and use a tighter custom role when the task does not need the complete supported operation set.
Related roles (2)
- Storage Actions Task Assignment Contributor: Microsoft documents the assignment role as creating task assignments and granting this execution role to the task managed identity.
- Storage Blob Data Owner: Microsoft states that Blob Data Owner also covers Storage Actions operations but is broader than this purpose-built role.
Common questions
When should I assign the Storage Actions Blob Data Operator Azure role?
Assign Storage Actions Blob Data Operator when you need to: Let a storage task managed identity execute lifecycle operations such as tier, expiry, tag, delete, or undelete on selected blobs.; and Run a storage task that sets blob immutability policies or legal holds on an approved target scope.. Practical scope: The role is assignable throughout the Azure hierarchy, but Microsoft documents assigning it to the storage task managed identity on the target storage account or container. Its Actions cover required container management and its DataActions cover all currently supported Storage Actions blob operations, including superuser operations.
What permissions does the Storage Actions Blob Data Operator Azure role grant?
The role definition grants 14 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; Microsoft.Resources/deployments/*; Microsoft.Resources/subscriptions/resourceGroups/read; Microsoft.Storage/storageAccounts/blobServices/containers/read; and Microsoft.Storage/storageAccounts/blobServices/containers/write. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Storage Actions Blob Data Operator Azure role?
Key considerations when assigning Storage Actions Blob Data Operator: The role can read and alter blob contents, delete or undelete blobs, and change tags.; Its superuser DataActions can set immutability policies and legal holds, so a task definition can affect retention and deletion controls.; and Microsoft documents this role as narrower than Storage Blob Data Owner for Storage Actions, but it remains a powerful service execution role.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (4)
- Azure built-in roles for Storage →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-16.
- Azure roles required to assign storage tasks →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.