Azure roles required to assign tasks

This article describes the least privileged built-in Azure roles or RBAC actions required to manage a storage task assignment.

Permission to manage storage task assignments

To create an assignment, your identity must be assigned either the Storage Blob Data Owner role or a custom role that contains the following RBAC actions:

• Microsoft.Authorization/roleAssignments/write
• Microsoft.Authorization/roleAssignments/delete
• Microsoft.Storage/storageAccounts/reports/read
• Microsoft.Storage/storageAccounts/read
• Microsoft.Storage/storageAccounts/blobServices/read
• Microsoft.Storage/storageAccounts/storageTaskAssignments/read
• Microsoft.Storage/storageAccounts/storageTaskAssignments/write
• Microsoft.Storage/storageAccounts/storageTaskAssignments/delete
• Microsoft.Storage/storageAccounts/storageTaskAssignments/reports/read

To learn how to create a custom role, see Azure custom roles.

Permission for a task to perform operations

As you create an assignment, you must choose an Azure built-in or custom role that has the permission necessary to perform the specified operations on the target storage account or storage account container. That role is assigned to the managed identity of the storage task. You can choose only roles that are assigned to your user identity.

The Storage Blob Data Owner role provides all of the permissions necessary for a storage task to perform all data operations. If you prefer to use a custom role, you must make sure that your role contains the RBAC actions necessary to perform the operations. The following table shows the RBAC actions required by each operation.

See also

• Create and manage an assignment