Azure Storage built-in role

Storage Actions Contributor

Authors and manages Azure Storage Actions storage tasks. It can create, read, update, delete, list, and preview tasks and view their assignments and reports, but it has no DataActions and does not assign a task to a storage account or execute blob operations.

Control-plane actions (10)

• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.StorageActions/storageTasks/read
• Microsoft.StorageActions/storageTasks/write
• Microsoft.StorageActions/storageTasks/delete
• Microsoft.StorageActions/storageTasks/storageTaskAssignments/read
• Microsoft.StorageActions/storageTasks/reports/read
• Microsoft.StorageActions/locations/previewActions/action

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The role is assignable throughout the Azure hierarchy. Assign it on the storage task or the resource group containing approved tasks. Its permissions are limited to the Storage Actions control plane and supporting reads; target storage data access belongs to the task managed identity.

Common use cases (2)

• Create or update a storage task definition, conditions, and supported operations.
• Preview task conditions and inspect task assignments and run reports without granting target-account data access.

Prerequisites (3)

• Identify the Storage Actions resource group and the task definitions the author is responsible for.
• Separate the identities that author tasks, assign them to accounts, and execute them when duties require separation.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the task scope.

Best practices (3)

• Use this purpose-built role instead of broad Contributor for storage-task authoring; Microsoft identifies it as the least privileged built-in authoring role.
• Keep task authors separate from task assigners when one person should not both define and deploy destructive operations.
• Review task conditions and preview results before an assigner deploys the task to production storage accounts.

Security considerations (3)

• The role cannot directly access blob data, but it can define tasks containing destructive, retention, or immutability operations.
• A task has no effect on a target account until separately assigned and its managed identity receives an execution role.
• Combining this role with Task Assignment Contributor lets one principal both define and deploy task behavior.

Assignment guidance

Assign Storage Actions Contributor to storage-task authors at the task or dedicated resource-group scope. Keep target-account assignment and execution permissions separate, and require review before a task with delete or retention operations is assigned.

Related roles (2)

• Storage Actions Task Assignment Contributor: Assigns an authored storage task to a target storage account.
• Storage Actions Blob Data Operator: Execution role granted to the storage task managed identity on its target scope.

Editorial sources (5)

• Azure built-in roles for Storage →

  Supports: Description, Practical scope. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Azure roles for storage tasks →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Azure roles required to assign storage tasks →

  Supports: Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →