Azure Storage built-in role
Storage Blob Delegator
Requests a Blob service user delegation key that can sign user delegation SAS tokens. The key cannot access blob data directly, and this role has no DataActions; the SAS can authorize only the intersection of the requester's RBAC or POSIX ACL permissions and the permissions encoded in the SAS.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: db58b8e5-c6ad-4a2a-8342-4190687cbf4a
Control-plane actions (1)
Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Get User Delegation Key operates at the storage-account level, so this role must be assigned at the storage account, resource group, or subscription. It can supplement a container-scoped blob data role without widening that direct data-role assignment to the whole account.
Common use cases (2)
- Let a trusted broker issue short-lived user delegation SAS tokens for clients that need limited Blob Storage access.
- Add delegation-key permission at account scope while keeping the broker's actual blob data role constrained to one container.
Prerequisites (3)
- Grant the SAS broker a separate blob data role or POSIX ACL that defines the maximum data access it may delegate.
- Design the SAS resource, permissions, expiry, HTTPS, optional IP restrictions, logging correlation, and revocation process.
- The assigning administrator needs Microsoft.Authorization/roleAssignments/write at storage-account scope or higher.
Best practices (3)
- Assign to a dedicated managed identity or service principal that brokers SAS tokens, not broadly to end users.
- Issue user delegation SAS tokens with the smallest resource scope, permissions, and lifetime and require HTTPS.
- Track SAS issuance in the broker because Azure Storage does not track how many SAS tokens are generated, and maintain a revocation plan.
Security considerations (3)
- A delegation key can sign any number of SAS tokens during its lifetime, which can be up to seven days.
- A leaked SAS can be used by its bearer until expiry or revocation; role and ACL changes and key revocation can take time to invalidate cached authorization.
- The role does not automatically read data, but combining it with a broad blob data role enables delegation of that broad access.
Assignment guidance
Assign Storage Blob Delegator to a trusted SAS-broker identity at the individual storage-account scope, together with a separately scoped blob data role that defines what it may delegate. Generate short-lived HTTPS-only SAS tokens, log issuance, and test revocation.
Related roles (2)
- Storage Blob Data Reader: A separate data role that can bound delegated access to read operations.
- Storage Blob Data Contributor: A separate data role that can bound delegated access to read and mutation operations.
Common questions
When should I assign the Storage Blob Delegator Azure role?
Assign Storage Blob Delegator when you need to: Let a trusted broker issue short-lived user delegation SAS tokens for clients that need limited Blob Storage access.; and Add delegation-key permission at account scope while keeping the broker's actual blob data role constrained to one container.. Practical scope: Get User Delegation Key operates at the storage-account level, so this role must be assigned at the storage account, resource group, or subscription. It can supplement a container-scoped blob data role without widening that direct data-role assignment to the whole account.
What permissions does the Storage Blob Delegator Azure role grant?
The role definition grants 1 combined control-plane and data-plane actions. Representative operations include: Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Storage Blob Delegator Azure role?
Key considerations when assigning Storage Blob Delegator: A delegation key can sign any number of SAS tokens during its lifetime, which can be up to seven days.; A leaked SAS can be used by its bearer until expiry or revocation; role and ACL changes and key revocation can take time to invalidate cached authorization.; and The role does not automatically read data, but combining it with a broad blob data role enables delegation of that broad access.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Storage →
Supports: Description. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope. Retrieved 2026-07-16.
- Grant limited access to data with shared access signatures →
Supports: Best practices, Security considerations. Retrieved 2026-07-16.
- Create a user delegation SAS →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Get User Delegation Key →
Supports: Description, Practical scope, Common use cases, Security considerations, Assignment guidance. Retrieved 2026-07-16.