// compare · azure roles

Storage Account Contributor vs Storage Blob Data Contributor

Two Azure built-in roles that are often confused, compared permission by permission.

In short: Storage Account Contributor has 9 actions. Storage Blob Data Contributor has 4 actions, 5 data actions. Assign the one with less access that still covers the job.

Detail	Storage Account Contributor	Storage Blob Data Contributor
What Microsoft says	Lets you manage storage accounts, including accessing storage account keys which provide full access to storage account data.	Allows for read, write and delete access to Azure Storage blob containers and data
Size	9 actions	4 actions, 5 data actions

Permissions only Storage Account Contributor lists (9)

Microsoft.Authorization/*/read
Microsoft.Insights/alertRules/*
Microsoft.Insights/diagnosticSettings/*
Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action
Microsoft.ResourceHealth/availabilityStatuses/read
Microsoft.Resources/deployments/*
Microsoft.Resources/subscriptions/resourceGroups/read
Microsoft.Storage/storageAccounts/*
Microsoft.Support/*

Permissions only Storage Blob Data Contributor lists (4)

Microsoft.Storage/storageAccounts/blobServices/containers/delete
Microsoft.Storage/storageAccounts/blobServices/containers/read
Microsoft.Storage/storageAccounts/blobServices/containers/write
Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action

Azure roles use wildcards such as *, and NotActions take permissions away, so a role can cover an action without listing it. Check the role pages for the full picture.

Storage Account Contributor explained Storage Blob Data Contributor explained

Sources

Microsoft Learn: Azure built-in roles

Spotted something out of date or wrong? Tell us and we'll fix it.