Azure roles required to assign tasks

This article describes the least privileged built-in Azure roles or RBAC actions required to manage a storage task assignment.

Permission to manage storage task assignments

To create a task assignment and to stop in-progress runs, your identity must be assigned either the Storage Actions Task Assignment Contributor as built-in role or a custom role that contains the following RBAC actions:

• Microsoft.Authorization/roleAssignments/write
• Microsoft.Authorization/roleAssignments/delete
• Microsoft.Storage/storageAccounts/reports/read
• Microsoft.Storage/storageAccounts/read
• Microsoft.Storage/storageAccounts/blobServices/read
• Microsoft.Storage/storageAccounts/storageTaskAssignments/read
• Microsoft.Storage/storageAccounts/storageTaskAssignments/write
• Microsoft.Storage/storageAccounts/storageTaskAssignments/delete
• Microsoft.Storage/storageAccounts/storageTaskAssignments/reports/read

To learn how to create a custom role, see Azure custom roles.

Permissions for a task to perform operations

As you create an assignment, choose an Azure built-in or custom role that has the permission necessary to perform the specified operations on the target storage account or storage account container. Assign that role to the managed identity of the storage task. You can choose only roles that are assigned to your user identity.

The recommended built-in role is Storage Actions Blob Data Operator. This role is purpose-built for the common data management conditions and operations that Storage Actions performs. It grants the minimum set of data-plane permissions required to access blob properties and execute operations supported by Storage Actions including setting blob index tags, expiry, immutability policies or legal hold, changing blob tiers, and deleting and undeleting blobs.

The Storage Actions Blob Data Operator role grants the following permissions:

If you prefer to use a custom role for the storage task's managed identity, ensure that your role contains the RBAC actions necessary to perform the operations defined in the task. The following table maps each Storage Actions operation to the RBAC actions a custom role must include.

See also

• Create and manage an assignment