Azure Storage built-in role

Storage Blob Data Contributor

Reads, writes, moves, adds, and deletes Azure Blob Storage data and manages blob containers within the assigned scope. It also includes the action to request a Blob user delegation key; unlike Storage Account Contributor, its DataActions directly authorize blob data access with Microsoft Entra credentials.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: ba92f5b4-2d11-453d-a403-e96b0029c9fe

Control-plane actions (4)

Data-plane actions (5)

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

The role can be assigned at an individual blob container, storage account, resource group, subscription, or management group, with inheritance to child blobs. Container scope limits direct data access to that container; the user-delegation-key action must be effective at storage-account scope or higher to request the key.

Common use cases (2)

Prerequisites (3)

Best practices (3)

Security considerations (3)

Assignment guidance

Assign Storage Blob Data Contributor to the workload identity on the specific container that it must modify. Add Reader separately only for portal navigation, and grant account-level delegation-key authority only when the workload must create a user delegation SAS.

Related roles (3)

Common questions

When should I assign the Storage Blob Data Contributor Azure role?

Assign Storage Blob Data Contributor when you need to: Run an application or data pipeline that must read, create, update, move, and delete blobs in an approved container.; and Manage container metadata and contents without granting storage-account keys or storage-account lifecycle administration.. Practical scope: The role can be assigned at an individual blob container, storage account, resource group, subscription, or management group, with inheritance to child blobs. Container scope limits direct data access to that container; the user-delegation-key action must be effective at storage-account scope or higher to request the key.

What permissions does the Storage Blob Data Contributor Azure role grant?

The role definition grants 9 combined control-plane and data-plane actions. Representative operations include: Microsoft.Storage/storageAccounts/blobServices/containers/delete; Microsoft.Storage/storageAccounts/blobServices/containers/read; Microsoft.Storage/storageAccounts/blobServices/containers/write; Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action; Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete; and Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Storage Blob Data Contributor Azure role?

Key considerations when assigning Storage Blob Data Contributor: The role can read, overwrite, move, add, and delete blob data in scope.; It can request a user delegation key when assigned at storage-account scope or higher, but a resulting SAS cannot exceed the principal's RBAC or POSIX ACL permissions and the permissions encoded in the SAS.; and A broad account, resource-group, subscription, or management-group assignment exposes every inheriting container and blob.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (8)

Official Microsoft Learn documentation →