Azure Storage built-in role

Storage Table Data Reader

Reads Azure Storage tables and queries table entities with Microsoft Entra authorization. It cannot create or delete tables and cannot add, update, merge, replace, or delete entities.

Control-plane actions (1)

• Microsoft.Storage/storageAccounts/tableServices/tables/read

Data-plane actions (1)

• Microsoft.Storage/storageAccounts/tableServices/tables/entities/read

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The role can be assigned at an individual table, storage account, resource group, subscription, or management group and is inherited by entities. Table scope confines reads to one table; Microsoft notes that table-scoped assignment currently requires PowerShell, Azure CLI, or a template.

Common use cases (2)

• Run a query-only application or report against one Azure Storage table.
• Give an auditor or support identity read-only visibility into table entities without allowing mutation.

Prerequisites (3)

• Identify the principal and individual table whose entities it must query.
• Use PowerShell, Azure CLI, or an Azure Resource Manager template for table-scoped assignment.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target scope.

Best practices (3)

• Assign to a group or managed identity at individual table scope.
• Use this role instead of Contributor for query-only workloads.
• Avoid listKeys-bearing roles that would permit Shared Key access beyond the read-only table boundary.

Security considerations (3)

• The role exposes table schema, properties, and entity data in scope.
• It cannot mutate tables or entities.
• A storage-account or parent assignment exposes every inheriting table and entity.

Assignment guidance

Assign Storage Table Data Reader to the query identity on the individual table using PowerShell, Azure CLI, or a template. Escalate to Table Data Contributor only when entity or table mutation is explicitly required.

Related roles (1)

• Storage Table Data Contributor: Adds table and entity create, update, and delete operations.

Editorial sources (5)

• Azure built-in roles for Storage →

  Supports: Description, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Security considerations. Retrieved 2026-07-16.

• Authorize access to tables using Microsoft Entra ID →

  Supports: Description, Practical scope, Common use cases, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Assign an Azure role for access to table data →

  Supports: Practical scope, Prerequisites, Best practices, Assignment guidance. Retrieved 2026-07-16.

Official Microsoft Learn documentation →