Azure Storage built-in role

Storage Blob Data Owner

Provides full access to Azure Blob Storage containers and blob data, including the ability to set ownership and manage POSIX access control for Azure Data Lake Storage. It also can request a Blob user delegation key and is broader than ordinary read/write/delete blob access.

Control-plane actions (2)

• Microsoft.Storage/storageAccounts/blobServices/containers/*
• Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action

Data-plane actions (1)

• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/*

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The role can be assigned at a container, storage account, resource group, subscription, or management group and is inherited by child blobs. Its container wildcard and blob DataAction wildcard apply within the effective scope; delegation-key requests require storage-account scope or higher.

Common use cases (2)

• Administer ownership, owning groups, POSIX permissions, and ACLs for an Azure Data Lake Storage namespace.
• Perform full container and blob administration when read/write/delete access alone is insufficient.

Prerequisites (3)

• Confirm that the principal genuinely needs POSIX ownership or ACL administration rather than Storage Blob Data Contributor.
• Identify the smallest container or account boundary containing the data to administer.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target scope.

Best practices (3)

• Reserve the role for data owners or tightly controlled service identities that administer ACLs.
• Assign at container scope when ownership administration is limited to one data domain.
• Use Storage Blob Data Contributor for ordinary mutation and Storage Blob Data Reader for read-only access.

Security considerations (3)

• The role has wildcard control over containers and blobs in scope, including delete and POSIX ownership or ACL changes.
• Changing ownership or ACLs can grant or remove other principals' data access.
• It can request a user delegation key at storage-account scope or higher and create SAS tokens bounded by its own broad permissions.

Assignment guidance

Assign Storage Blob Data Owner only where the principal must administer POSIX ownership or ACLs or otherwise needs full blob control. Scope it to the relevant container, use groups or managed identities, and choose Contributor or Reader when ownership administration is not required.

Related roles (2)

• Storage Blob Data Contributor: Read, write, move, and delete alternative without full POSIX ownership and ACL administration.
• Storage Blob Data Reader: Read-only blob data alternative.

Editorial sources (7)

• Azure built-in roles for Storage →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Authorize Blob Storage access with Microsoft Entra ID →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Assign an Azure role for Blob Storage data access →

  Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.

• Create a user delegation SAS →

  Supports: Practical scope, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →