Azure Storage built-in role

Storage Actions Task Assignment Contributor

Creates, updates, and deletes Storage Actions task assignments on target storage accounts and can grant or remove Storage Actions Blob Data Operator. Its ABAC condition restricts only the role definition ID for role-assignment write and delete; it does not restrict principal type or require the assignee to be the storage task managed identity.

Control-plane actions (13)

• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Storage/storageAccounts/reports/read
• Microsoft.Storage/storageAccounts/read
• Microsoft.Storage/storageAccounts/blobServices/read
• Microsoft.Storage/storageAccounts/storageTaskAssignments/read
• Microsoft.Storage/storageAccounts/storageTaskAssignments/write
• Microsoft.Storage/storageAccounts/storageTaskAssignments/delete
• Microsoft.Storage/storageAccounts/storageTaskAssignments/reports/read
• Microsoft.Authorization/roleAssignments/write
• Microsoft.Authorization/roleAssignments/delete

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Conditions (1)

• Condition version: 2.0

  ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{4bad4d9e2a13488894bbc8432f6f3040})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{4bad4d9e2a13488894bbc8432f6f3040}))

Assignable scopes (1)

• /

Practical scope

The role is assignable throughout the Azure hierarchy, but Microsoft documents it on the target storage account or containing approved scope. Its management Actions govern task assignments and reports; conditioned Azure RBAC Actions can grant or remove only Storage Actions Blob Data Operator, but can target any principal permitted at the effective scope.

Common use cases (2)

• Deploy an approved storage task to a target storage account or container and configure its assignment parameters.
• Grant the task managed identity the purpose-built blob execution role required to perform the configured operations.

Prerequisites (4)

• The storage task and managed identity must exist and the task definition must be approved for the target account.
• The assigner can choose only an execution role already assigned to the assigner; Microsoft recommends Storage Actions Blob Data Operator.
• Verify the target principal independently because the built-in condition does not constrain principal ID or principal type.
• The administrator assigning this role needs Microsoft.Authorization/roleAssignments/write at the target account scope.

Best practices (3)

• Assign on the target storage account and preserve the built-in ABAC condition that limits role delegation.
• Keep task assignment separate from task authoring for tasks that delete data or change retention controls.
• Before each role assignment, separately verify the target principal is the intended task managed identity; review assignment scope, filters, reports, and the resulting role assignment after deployment.

Security considerations (3)

• The role can deploy tasks that modify or delete blobs and can grant a powerful data execution role to any principal permitted at scope.
• The ABAC condition prevents delegation of role definitions other than Storage Actions Blob Data Operator, but it does not prevent selecting an arbitrary principal.
• Deleting an assignment can stop expected lifecycle processing, while an overly broad target scope can expose unrelated blob data to the task.

Assignment guidance

Assign Storage Actions Task Assignment Contributor to approved task deployers on each target storage account. Preserve the built-in condition, but separately verify the target principal because the condition limits only the role definition ID. Grant Storage Actions Blob Data Operator only to the intended principal after reviewing the task's operations, filters, and scope.

Related roles (2)

• Storage Actions Contributor: Authors the storage task that this role assigns to a target account.
• Storage Actions Blob Data Operator: The role-assignment condition explicitly limits this assigner to granting or removing that execution role.

Editorial sources (6)

• Azure built-in roles for Storage →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Azure roles for storage tasks →

  Supports: Related roles. Retrieved 2026-07-16.

• Azure roles required to assign storage tasks →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →