Azure Storage built-in role

Storage Table Data Contributor

Reads, creates, updates, and deletes Azure Storage tables and table entities with Microsoft Entra authorization. It directly grants Table Storage data access without granting storage-account keys or general storage-account management.

Control-plane actions (3)

• Microsoft.Storage/storageAccounts/tableServices/tables/read
• Microsoft.Storage/storageAccounts/tableServices/tables/write
• Microsoft.Storage/storageAccounts/tableServices/tables/delete

Data-plane actions (5)

• Microsoft.Storage/storageAccounts/tableServices/tables/entities/read
• Microsoft.Storage/storageAccounts/tableServices/tables/entities/write
• Microsoft.Storage/storageAccounts/tableServices/tables/entities/delete
• Microsoft.Storage/storageAccounts/tableServices/tables/entities/add/action
• Microsoft.Storage/storageAccounts/tableServices/tables/entities/update/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The role can be assigned at an individual table, storage account, resource group, subscription, or management group and is inherited by table entities. Table scope confines operations to one table; Microsoft notes that table-scoped role assignment currently requires PowerShell, Azure CLI, or a template rather than the portal.

Common use cases (2)

• Run an application that must query, insert, merge, replace, update, or delete entities in one table.
• Create or delete approved tables and manage their entities without granting Shared Key access.

Prerequisites (3)

• Identify the user, group, service principal, or managed identity and the individual tables it must modify.
• Use PowerShell, Azure CLI, or an Azure Resource Manager template for table-scoped assignment.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the table or parent scope.

Best practices (3)

• Assign to a managed identity and at individual table scope whenever possible.
• Use Storage Table Data Reader when entity mutation and table management are not required.
• Prefer Microsoft Entra authorization over account keys and monitor broad parent assignments.

Security considerations (3)

• The role can query, insert, update, merge, replace, and delete entities and can create or delete tables in scope.
• Entity mutations or table deletion can cause application data loss or integrity failures.
• A storage-account or parent assignment exposes every inheriting table and entity.

Assignment guidance

Assign Storage Table Data Contributor to the workload identity on the individual table using PowerShell, Azure CLI, or a template. Use Reader for query-only workloads and avoid a storage-account scope unless the application must manage every table in the account.

Related roles (1)

• Storage Table Data Reader: Read-only table and entity alternative.

Editorial sources (6)

• Azure built-in roles for Storage →

  Supports: Description, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Security considerations. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Authorize access to tables using Microsoft Entra ID →

  Supports: Description, Practical scope, Common use cases, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Assign an Azure role for access to table data →

  Supports: Practical scope, Prerequisites, Best practices, Assignment guidance. Retrieved 2026-07-16.

Official Microsoft Learn documentation →