Azure roles required to assign tasks

This article describes the least privileged built-in Azure roles or RBAC actions required to manage a storage task assignment.

Permission to manage storage task assignments

To create an assignment, your identity must be assigned either the Storage Actions Task Assignment Contributor as built-in role or a custom role that contains the following RBAC actions:

• Microsoft.Authorization/roleAssignments/write
• Microsoft.Authorization/roleAssignments/delete
• Microsoft.Storage/storageAccounts/reports/read
• Microsoft.Storage/storageAccounts/read
• Microsoft.Storage/storageAccounts/blobServices/read
• Microsoft.Storage/storageAccounts/storageTaskAssignments/read
• Microsoft.Storage/storageAccounts/storageTaskAssignments/write
• Microsoft.Storage/storageAccounts/storageTaskAssignments/delete
• Microsoft.Storage/storageAccounts/storageTaskAssignments/reports/read

To learn how to create a custom role, see Azure custom roles.

Permission for a task to perform operations

As you create an assignment, you must choose an Azure built-in or custom role that has the permission necessary to perform the specified operations on the target storage account or storage account container. That role is assigned to the managed identity of the storage task. You can choose only roles that are assigned to your user identity.

The recommended built-in role is Storage Actions Blob Data Operator. This is a purpose-built role for the Storage Actions managed identity. It grants exactly the data-plane permissions required to execute all operations supported by Storage Actions today — including tier changes, tags, expiry, delete, undelete, immutability, and legal hold - without granting broader access to your data.

The Storage Actions Blob Data Operator role grants the following permissions:

If you prefer to use a custom role for the storage task's managed identity, you must make sure that your role contains the RBAC actions necessary to perform the operations defined in the task. The following table maps each Storage Actions operation to the RBAC actions a custom role must include.

See also

• Create and manage an assignment