Azure Storage built-in role
Storage Actions Contributor
Authors and manages Azure Storage Actions storage tasks. It can create, read, update, delete, list, and preview tasks and view their assignments and reports, but it has no DataActions and does not assign a task to a storage account or execute blob operations.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: bd8acdb0-202c-4493-a7fe-ef98eefbfbc4
Control-plane actions (10)
Microsoft.Authorization/*/readMicrosoft.Insights/alertRules/*Microsoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.StorageActions/storageTasks/readMicrosoft.StorageActions/storageTasks/writeMicrosoft.StorageActions/storageTasks/deleteMicrosoft.StorageActions/storageTasks/storageTaskAssignments/readMicrosoft.StorageActions/storageTasks/reports/readMicrosoft.StorageActions/locations/previewActions/action
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
The role is assignable throughout the Azure hierarchy. Assign it on the storage task or the resource group containing approved tasks. Its permissions are limited to the Storage Actions control plane and supporting reads; target storage data access belongs to the task managed identity.
Common use cases (2)
- Create or update a storage task definition, conditions, and supported operations.
- Preview task conditions and inspect task assignments and run reports without granting target-account data access.
Prerequisites (3)
- Identify the Storage Actions resource group and the task definitions the author is responsible for.
- Separate the identities that author tasks, assign them to accounts, and execute them when duties require separation.
- The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the task scope.
Best practices (3)
- Use this purpose-built role instead of broad Contributor for storage-task authoring; Microsoft identifies it as the least privileged built-in authoring role.
- Keep task authors separate from task assigners when one person should not both define and deploy destructive operations.
- Review task conditions and preview results before an assigner deploys the task to production storage accounts.
Security considerations (3)
- The role cannot directly access blob data, but it can define tasks containing destructive, retention, or immutability operations.
- A task has no effect on a target account until separately assigned and its managed identity receives an execution role.
- Combining this role with Task Assignment Contributor lets one principal both define and deploy task behavior.
Assignment guidance
Assign Storage Actions Contributor to storage-task authors at the task or dedicated resource-group scope. Keep target-account assignment and execution permissions separate, and require review before a task with delete or retention operations is assigned.
Related roles (2)
- Storage Actions Task Assignment Contributor: Assigns an authored storage task to a target storage account.
- Storage Actions Blob Data Operator: Execution role granted to the storage task managed identity on its target scope.
Common questions
When should I assign the Storage Actions Contributor Azure role?
Assign Storage Actions Contributor when you need to: Create or update a storage task definition, conditions, and supported operations.; and Preview task conditions and inspect task assignments and run reports without granting target-account data access.. Practical scope: The role is assignable throughout the Azure hierarchy. Assign it on the storage task or the resource group containing approved tasks. Its permissions are limited to the Storage Actions control plane and supporting reads; target storage data access belongs to the task managed identity.
What permissions does the Storage Actions Contributor Azure role grant?
The role definition grants 10 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; Microsoft.Resources/deployments/*; Microsoft.Resources/subscriptions/resourceGroups/read; Microsoft.StorageActions/storageTasks/read; and Microsoft.StorageActions/storageTasks/write. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Storage Actions Contributor Azure role?
Key considerations when assigning Storage Actions Contributor: The role cannot directly access blob data, but it can define tasks containing destructive, retention, or immutability operations.; A task has no effect on a target account until separately assigned and its managed identity receives an execution role.; and Combining this role with Task Assignment Contributor lets one principal both define and deploy task behavior.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for Storage →
Supports: Description, Practical scope. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Azure roles for storage tasks →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Azure roles required to assign storage tasks →
Supports: Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.