// roles/azure · containers

Azure Container Storage OperatorAzure built-in role

Role required by a Managed Identity for Azure Container Storage operations

Role ID	`08d4c71a-cc63-4ce4-a9c8-5dd251b4d619`
Category	Containers
Actions	18
Data actions	0

What it can do

Permission	What it allows
`Microsoft.ElasticSan/elasticSans/*`	Every operation under Microsoft.ElasticSan/elasticSans
`Microsoft.ElasticSan/locations/asyncoperations/read`	Polls the status of an asynchronous operation.
`Microsoft.Network/routeTables/join/action`	Joins a route table. Not Alertable.
`Microsoft.Network/networkSecurityGroups/join/action`	Joins a network security group. Not Alertable.
`Microsoft.Network/virtualNetworks/write`	Creates a virtual network or updates an existing virtual network
`Microsoft.Network/virtualNetworks/delete`	Deletes a virtual network
`Microsoft.Network/virtualNetworks/join/action`	Joins a virtual network. Not Alertable.
`Microsoft.Network/virtualNetworks/subnets/read`	Gets a virtual network subnet definition
`Microsoft.Network/virtualNetworks/subnets/write`	Creates a virtual network subnet or updates an existing virtual network subnet
`Microsoft.Compute/virtualMachines/read`	Get the properties of a virtual machine
`Microsoft.Compute/virtualMachines/write`	Creates a new virtual machine or updates an existing virtual machine
`Microsoft.Compute/virtualMachineScaleSets/read`	Get the properties of a Virtual Machine Scale Set
`Microsoft.Compute/virtualMachineScaleSets/write`	Creates a new Virtual Machine Scale Set or updates an existing one
`Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write`	Updates the properties of a Virtual Machine in a VM Scale Set
`Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read`	Retrieves the properties of a Virtual Machine in a VM Scale Set
`Microsoft.Resources/subscriptions/providers/read`	Gets or lists resource providers.
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Network/virtualNetworks/read`	Get the virtual network definition

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Azure Container Storage Operator" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Azure Container Storage Operator" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '08d4c71a-cc63-4ce4-a9c8-5dd251b4d619')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '08d4c71a-cc63-4ce4-a9c8-5dd251b4d619')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "08d4c71a-cc63-4ce4-a9c8-5dd251b4d619"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other containers roles

AcrDelete · 1 permission
AcrPull · 1 permission
Connected Cluster Managed Identity CheckAccess Reader · 1 permission
Container Registry Cache Rule Reader · 1 permission
Container Registry Credential Set Reader · 1 permission
Container Registry Repository Catalog Lister · 1 permission
AcrImageSigner · 2 permissions
AcrPush · 2 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles