Azure Storage built-in role

Storage Blob Data Reader

Reads and lists Azure Blob Storage containers and blob data with Microsoft Entra authorization. It cannot write or delete blobs, but it includes the action to request a Blob user delegation key when the assignment is effective at storage-account scope or higher.

Control-plane actions (2)

• Microsoft.Storage/storageAccounts/blobServices/containers/read
• Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action

Data-plane actions (1)

• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The role can be assigned at a container, storage account, resource group, subscription, or management group and is inherited by child blobs. Container scope limits blob reads to that container; requesting a user delegation key requires storage-account scope or higher.

Common use cases (2)

• Let an application, analyst, or auditor read blobs from one approved container without modifying them.
• Provide Microsoft Entra-authenticated read access to a Blob Storage or Data Lake Storage dataset.

Prerequisites (3)

• Identify the principal and narrowest container or account scope containing the data it must read.
• For portal navigation using Microsoft Entra credentials, also grant an Azure Resource Manager role such as Reader at the storage-account scope.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target scope.

Best practices (3)

• Assign to groups for people or managed identities for applications, at container scope whenever possible.
• Do not add Contributor or Owner when the workload only reads data.
• Use Microsoft Entra authorization and avoid account-key access that would bypass this read-only boundary.

Security considerations (3)

• Read access can expose every blob and its metadata in the effective scope.
• The role cannot alter blob data, but a broad parent assignment exposes multiple accounts or containers.
• A user delegation SAS created by this principal cannot exceed the principal's read permissions and the permissions encoded in the SAS.

Assignment guidance

Assign Storage Blob Data Reader on the specific container the principal must read. Add Reader only for portal navigation, and do not widen the role to storage-account scope merely to obtain a delegation key unless SAS issuance is an explicit requirement.

Related roles (2)

• Storage Blob Data Contributor: Adds blob create, update, move, and delete operations.
• Storage Blob Delegator: Can be added at storage-account scope when this read role remains container-scoped and the principal must request a user delegation key.

Editorial sources (6)

• Azure built-in roles for Storage →

  Supports: Description, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Security considerations. Retrieved 2026-07-16.

• Authorize Blob Storage access with Microsoft Entra ID →

  Supports: Description, Practical scope, Common use cases, Best practices, Related roles. Retrieved 2026-07-16.

• Assign an Azure role for Blob Storage data access →

  Supports: Practical scope, Prerequisites, Best practices, Assignment guidance. Retrieved 2026-07-16.

• Create a user delegation SAS →

  Supports: Practical scope, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →