Azure Storage built-in role

Storage Blob Data Contributor

Reads, writes, moves, adds, and deletes Azure Blob Storage data and manages blob containers within the assigned scope. It also includes the action to request a Blob user delegation key; unlike Storage Account Contributor, its DataActions directly authorize blob data access with Microsoft Entra credentials.

Control-plane actions (4)

• Microsoft.Storage/storageAccounts/blobServices/containers/delete
• Microsoft.Storage/storageAccounts/blobServices/containers/read
• Microsoft.Storage/storageAccounts/blobServices/containers/write
• Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action

Data-plane actions (5)

• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete
• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read
• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write
• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/move/action
• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The role can be assigned at an individual blob container, storage account, resource group, subscription, or management group, with inheritance to child blobs. Container scope limits direct data access to that container; the user-delegation-key action must be effective at storage-account scope or higher to request the key.

Common use cases (2)

• Run an application or data pipeline that must read, create, update, move, and delete blobs in an approved container.
• Manage container metadata and contents without granting storage-account keys or storage-account lifecycle administration.

Prerequisites (3)

• Identify the user, group, service principal, or managed identity and the narrowest container or account scope it requires.
• For portal navigation using Microsoft Entra credentials, also grant an Azure Resource Manager read role such as Reader at the storage-account scope.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target scope.

Best practices (3)

• Assign to managed identities for applications and scope to an individual container whenever possible.
• Use Storage Blob Data Reader when writes and deletes are not required, and Storage Blob Data Owner only for POSIX ownership or ACL administration.
• Prefer Microsoft Entra authorization over Shared Key and add Azure ABAC conditions when supported attributes can narrow access further.

Security considerations (3)

• The role can read, overwrite, move, add, and delete blob data in scope.
• It can request a user delegation key when assigned at storage-account scope or higher, but a resulting SAS cannot exceed the principal's RBAC or POSIX ACL permissions and the permissions encoded in the SAS.
• A broad account, resource-group, subscription, or management-group assignment exposes every inheriting container and blob.

Assignment guidance

Assign Storage Blob Data Contributor to the workload identity on the specific container that it must modify. Add Reader separately only for portal navigation, and grant account-level delegation-key authority only when the workload must create a user delegation SAS.

Related roles (3)

• Storage Blob Data Reader: Read-only blob data alternative.
• Storage Blob Data Owner: Adds full container and blob access, including POSIX ownership and ACL administration.
• Storage Blob Delegator: Can be added at storage-account scope when data access is container-scoped and the principal also needs a user delegation key.

Editorial sources (8)

• Azure built-in roles for Storage →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Security considerations. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Authorize operations for data access in Azure Storage →

  Supports: Best practices. Retrieved 2026-07-16.

• Authorize Blob Storage access with Microsoft Entra ID →

  Supports: Description, Practical scope, Common use cases, Best practices, Related roles. Retrieved 2026-07-16.

• Assign an Azure role for Blob Storage data access →

  Supports: Practical scope, Common use cases, Prerequisites, Best practices, Assignment guidance. Retrieved 2026-07-16.

• Create a user delegation SAS →

  Supports: Practical scope, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →