Azure Storage built-in role

Storage Blob Delegator

Requests a Blob service user delegation key that can sign user delegation SAS tokens. The key cannot access blob data directly, and this role has no DataActions; the SAS can authorize only the intersection of the requester's RBAC or POSIX ACL permissions and the permissions encoded in the SAS.

Control-plane actions (1)

• Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Get User Delegation Key operates at the storage-account level, so this role must be assigned at the storage account, resource group, or subscription. It can supplement a container-scoped blob data role without widening that direct data-role assignment to the whole account.

Common use cases (2)

• Let a trusted broker issue short-lived user delegation SAS tokens for clients that need limited Blob Storage access.
• Add delegation-key permission at account scope while keeping the broker's actual blob data role constrained to one container.

Prerequisites (3)

• Grant the SAS broker a separate blob data role or POSIX ACL that defines the maximum data access it may delegate.
• Design the SAS resource, permissions, expiry, HTTPS, optional IP restrictions, logging correlation, and revocation process.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at storage-account scope or higher.

Best practices (3)

• Assign to a dedicated managed identity or service principal that brokers SAS tokens, not broadly to end users.
• Issue user delegation SAS tokens with the smallest resource scope, permissions, and lifetime and require HTTPS.
• Track SAS issuance in the broker because Azure Storage does not track how many SAS tokens are generated, and maintain a revocation plan.

Security considerations (3)

• A delegation key can sign any number of SAS tokens during its lifetime, which can be up to seven days.
• A leaked SAS can be used by its bearer until expiry or revocation; role and ACL changes and key revocation can take time to invalidate cached authorization.
• The role does not automatically read data, but combining it with a broad blob data role enables delegation of that broad access.

Assignment guidance

Assign Storage Blob Delegator to a trusted SAS-broker identity at the individual storage-account scope, together with a separately scoped blob data role that defines what it may delegate. Generate short-lived HTTPS-only SAS tokens, log issuance, and test revocation.

Related roles (2)

• Storage Blob Data Reader: A separate data role that can bound delegated access to read operations.
• Storage Blob Data Contributor: A separate data role that can bound delegated access to read and mutation operations.

Editorial sources (6)

• Azure built-in roles for Storage →

  Supports: Description. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope. Retrieved 2026-07-16.

• Grant limited access to data with shared access signatures →

  Supports: Best practices, Security considerations. Retrieved 2026-07-16.

• Create a user delegation SAS →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Get User Delegation Key →

  Supports: Description, Practical scope, Common use cases, Security considerations, Assignment guidance. Retrieved 2026-07-16.

Official Microsoft Learn documentation →