← cd ~/compare
// compare · azure roles
Storage Blob Data Owner vs Storage Blob Data Contributor
Two Azure built-in roles that are often confused, compared permission by permission.
In short: Storage Blob Data Owner has 2 actions, 1 data actions. Storage Blob Data Contributor has 4 actions, 5 data actions. Assign the one with less access that still covers the job.
| Storage Blob Data Owner | Storage Blob Data Contributor | |
|---|---|---|
| What Microsoft says | Allows for full access to Azure Storage blob containers and data, including assigning POSIX access control. | Allows for read, write and delete access to Azure Storage blob containers and data |
| Size | 2 actions, 1 data actions | 4 actions, 5 data actions |
Permissions only Storage Blob Data Owner lists (1)
Microsoft.Storage/storageAccounts/blobServices/containers/*
Permissions only Storage Blob Data Contributor lists (3)
Microsoft.Storage/storageAccounts/blobServices/containers/deleteMicrosoft.Storage/storageAccounts/blobServices/containers/readMicrosoft.Storage/storageAccounts/blobServices/containers/write
Azure roles use wildcards such as *, and NotActions take permissions away, so a role can cover an action without listing it. Check the role pages for the full picture.
Storage Blob Data Owner explained Storage Blob Data Contributor explained