Azure Storage built-in role
Storage Blob Data Reader
Reads and lists Azure Blob Storage containers and blob data with Microsoft Entra authorization. It cannot write or delete blobs, but it includes the action to request a Blob user delegation key when the assignment is effective at storage-account scope or higher.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 2a2b9908-6ea1-4ae2-8e65-a410df84e7d1
Control-plane actions (2)
Microsoft.Storage/storageAccounts/blobServices/containers/readMicrosoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action
Data-plane actions (1)
Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
The role can be assigned at a container, storage account, resource group, subscription, or management group and is inherited by child blobs. Container scope limits blob reads to that container; requesting a user delegation key requires storage-account scope or higher.
Common use cases (2)
- Let an application, analyst, or auditor read blobs from one approved container without modifying them.
- Provide Microsoft Entra-authenticated read access to a Blob Storage or Data Lake Storage dataset.
Prerequisites (3)
- Identify the principal and narrowest container or account scope containing the data it must read.
- For portal navigation using Microsoft Entra credentials, also grant an Azure Resource Manager role such as Reader at the storage-account scope.
- The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target scope.
Best practices (3)
- Assign to groups for people or managed identities for applications, at container scope whenever possible.
- Do not add Contributor or Owner when the workload only reads data.
- Use Microsoft Entra authorization and avoid account-key access that would bypass this read-only boundary.
Security considerations (3)
- Read access can expose every blob and its metadata in the effective scope.
- The role cannot alter blob data, but a broad parent assignment exposes multiple accounts or containers.
- A user delegation SAS created by this principal cannot exceed the principal's read permissions and the permissions encoded in the SAS.
Assignment guidance
Assign Storage Blob Data Reader on the specific container the principal must read. Add Reader only for portal navigation, and do not widen the role to storage-account scope merely to obtain a delegation key unless SAS issuance is an explicit requirement.
Related roles (2)
- Storage Blob Data Contributor: Adds blob create, update, move, and delete operations.
- Storage Blob Delegator: Can be added at storage-account scope when this read role remains container-scoped and the principal must request a user delegation key.
Common questions
When should I assign the Storage Blob Data Reader Azure role?
Assign Storage Blob Data Reader when you need to: Let an application, analyst, or auditor read blobs from one approved container without modifying them.; and Provide Microsoft Entra-authenticated read access to a Blob Storage or Data Lake Storage dataset.. Practical scope: The role can be assigned at a container, storage account, resource group, subscription, or management group and is inherited by child blobs. Container scope limits blob reads to that container; requesting a user delegation key requires storage-account scope or higher.
What permissions does the Storage Blob Data Reader Azure role grant?
The role definition grants 3 combined control-plane and data-plane actions. Representative operations include: Microsoft.Storage/storageAccounts/blobServices/containers/read; Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action; and Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Storage Blob Data Reader Azure role?
Key considerations when assigning Storage Blob Data Reader: Read access can expose every blob and its metadata in the effective scope.; The role cannot alter blob data, but a broad parent assignment exposes multiple accounts or containers.; and A user delegation SAS created by this principal cannot exceed the principal's read permissions and the permissions encoded in the SAS.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Storage →
Supports: Description, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Security considerations. Retrieved 2026-07-16.
- Authorize Blob Storage access with Microsoft Entra ID →
Supports: Description, Practical scope, Common use cases, Best practices, Related roles. Retrieved 2026-07-16.
- Assign an Azure role for Blob Storage data access →
Supports: Practical scope, Prerequisites, Best practices, Assignment guidance. Retrieved 2026-07-16.
- Create a user delegation SAS →
Supports: Practical scope, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.