Azure Storage built-in role
Storage Blob Data Owner
Provides full access to Azure Blob Storage containers and blob data, including the ability to set ownership and manage POSIX access control for Azure Data Lake Storage. It also can request a Blob user delegation key and is broader than ordinary read/write/delete blob access.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: b7e6dc6d-f1e8-4753-8033-0f276bb0955b
Control-plane actions (2)
Microsoft.Storage/storageAccounts/blobServices/containers/*Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action
Data-plane actions (1)
Microsoft.Storage/storageAccounts/blobServices/containers/blobs/*
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
The role can be assigned at a container, storage account, resource group, subscription, or management group and is inherited by child blobs. Its container wildcard and blob DataAction wildcard apply within the effective scope; delegation-key requests require storage-account scope or higher.
Common use cases (2)
- Administer ownership, owning groups, POSIX permissions, and ACLs for an Azure Data Lake Storage namespace.
- Perform full container and blob administration when read/write/delete access alone is insufficient.
Prerequisites (3)
- Confirm that the principal genuinely needs POSIX ownership or ACL administration rather than Storage Blob Data Contributor.
- Identify the smallest container or account boundary containing the data to administer.
- The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target scope.
Best practices (3)
- Reserve the role for data owners or tightly controlled service identities that administer ACLs.
- Assign at container scope when ownership administration is limited to one data domain.
- Use Storage Blob Data Contributor for ordinary mutation and Storage Blob Data Reader for read-only access.
Security considerations (3)
- The role has wildcard control over containers and blobs in scope, including delete and POSIX ownership or ACL changes.
- Changing ownership or ACLs can grant or remove other principals' data access.
- It can request a user delegation key at storage-account scope or higher and create SAS tokens bounded by its own broad permissions.
Assignment guidance
Assign Storage Blob Data Owner only where the principal must administer POSIX ownership or ACLs or otherwise needs full blob control. Scope it to the relevant container, use groups or managed identities, and choose Contributor or Reader when ownership administration is not required.
Related roles (2)
- Storage Blob Data Contributor: Read, write, move, and delete alternative without full POSIX ownership and ACL administration.
- Storage Blob Data Reader: Read-only blob data alternative.
Common questions
When should I assign the Storage Blob Data Owner Azure role?
Assign Storage Blob Data Owner when you need to: Administer ownership, owning groups, POSIX permissions, and ACLs for an Azure Data Lake Storage namespace.; and Perform full container and blob administration when read/write/delete access alone is insufficient.. Practical scope: The role can be assigned at a container, storage account, resource group, subscription, or management group and is inherited by child blobs. Its container wildcard and blob DataAction wildcard apply within the effective scope; delegation-key requests require storage-account scope or higher.
What permissions does the Storage Blob Data Owner Azure role grant?
The role definition grants 3 combined control-plane and data-plane actions. Representative operations include: Microsoft.Storage/storageAccounts/blobServices/containers/*; Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action; and Microsoft.Storage/storageAccounts/blobServices/containers/blobs/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Storage Blob Data Owner Azure role?
Key considerations when assigning Storage Blob Data Owner: The role has wildcard control over containers and blobs in scope, including delete and POSIX ownership or ACL changes.; Changing ownership or ACLs can grant or remove other principals' data access.; and It can request a user delegation key at storage-account scope or higher and create SAS tokens bounded by its own broad permissions.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Storage →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-16.
- Authorize Blob Storage access with Microsoft Entra ID →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Assign an Azure role for Blob Storage data access →
Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.
- Create a user delegation SAS →
Supports: Practical scope, Security considerations. Retrieved 2026-07-16.