// roles/azure · storage

Backup ContributorAzure built-in role

Lets you manage backups, but can't delete vaults and give access to others

Role ID	`5e467623-bb1f-42f4-a55d-6e525e11384b`
Category	Storage
Actions	84
Data actions	0

What it can do

Permission	What it allows
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Network/virtualNetworks/read`	Get the virtual network definition
`Microsoft.RecoveryServices/locations/*`	Every operation under Microsoft.RecoveryServices/locations
`Microsoft.RecoveryServices/Vaults/backupFabrics/operationResults/*`	Every operation under Microsoft.RecoveryServices/Vaults/backupFabrics/operationResults
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/*`	Every operation under Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers
`Microsoft.RecoveryServices/Vaults/backupFabrics/refreshContainers/action`	Refreshes the container list
`Microsoft.RecoveryServices/Vaults/backupJobs/*`	Every operation under Microsoft.RecoveryServices/Vaults/backupJobs
`Microsoft.RecoveryServices/Vaults/backupJobsExport/action`	Export Jobs
`Microsoft.RecoveryServices/Vaults/backupOperationResults/*`	Every operation under Microsoft.RecoveryServices/Vaults/backupOperationResults
`Microsoft.RecoveryServices/Vaults/backupPolicies/*`	Every operation under Microsoft.RecoveryServices/Vaults/backupPolicies
`Microsoft.RecoveryServices/Vaults/backupProtectableItems/*`	Every operation under Microsoft.RecoveryServices/Vaults/backupProtectableItems
`Microsoft.RecoveryServices/Vaults/backupProtectedItems/*`	Every operation under Microsoft.RecoveryServices/Vaults/backupProtectedItems
`Microsoft.RecoveryServices/Vaults/backupProtectionContainers/*`	Every operation under Microsoft.RecoveryServices/Vaults/backupProtectionContainers
`Microsoft.RecoveryServices/Vaults/backupSecurityPIN/*`	Every operation under Microsoft.RecoveryServices/Vaults/backupSecurityPIN
`Microsoft.RecoveryServices/Vaults/backupUsageSummaries/read`	Returns summaries for Protected Items and Protected Servers for a Recovery Services .
`Microsoft.RecoveryServices/Vaults/certificates/*`	Every operation under Microsoft.RecoveryServices/Vaults/certificates
`Microsoft.RecoveryServices/Vaults/extendedInformation/*`	Every operation under Microsoft.RecoveryServices/Vaults/extendedInformation
`Microsoft.RecoveryServices/Vaults/monitoringAlerts/read`	Gets the alerts for the Recovery services vault.
`Microsoft.RecoveryServices/Vaults/monitoringConfigurations/*`	Every operation under Microsoft.RecoveryServices/Vaults/monitoringConfigurations
`Microsoft.RecoveryServices/Vaults/read`	The Get Vault operation gets an object representing the Azure resource of type 'vault'
`Microsoft.RecoveryServices/Vaults/registeredIdentities/*`	Every operation under Microsoft.RecoveryServices/Vaults/registeredIdentities
`Microsoft.RecoveryServices/Vaults/usages/*`	Every operation under Microsoft.RecoveryServices/Vaults/usages
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Storage/storageAccounts/read`	Returns the list of storage accounts or gets the properties for the specified storage account.
`Microsoft.RecoveryServices/Vaults/backupstorageconfig/*`	Every operation under Microsoft.RecoveryServices/Vaults/backupstorageconfig
`Microsoft.RecoveryServices/Vaults/backupconfig/*`	Every operation under Microsoft.RecoveryServices/Vaults/backupconfig
`Microsoft.RecoveryServices/Vaults/backupValidateOperation/action`	Validate Operation on Protected Item
`Microsoft.RecoveryServices/Vaults/write`	Create Vault operation creates an Azure resource of type 'vault'
`Microsoft.RecoveryServices/Vaults/backupOperations/read`	Returns Backup Operation Status for Recovery Services Vault.
`Microsoft.RecoveryServices/Vaults/backupEngines/read`	Returns all the backup management servers registered with vault.
`Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/*`	Every operation under Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectableContainers/read`	Get all protectable containers
`Microsoft.RecoveryServices/vaults/operationStatus/read`	Gets Operation Status for a given Operation
`Microsoft.RecoveryServices/vaults/operationResults/read`	The Get Operation Results operation can be used get the operation status and result for the asynchronously submitted operation
`Microsoft.RecoveryServices/locations/backupStatus/action`	Check Backup Status for Recovery Services Vaults
`Microsoft.RecoveryServices/locations/backupPreValidateProtection/action`
`Microsoft.RecoveryServices/locations/backupValidateFeatures/action`	Validate Features
`Microsoft.RecoveryServices/Vaults/monitoringAlerts/write`	Resolves the alert.
`Microsoft.RecoveryServices/operations/read`	Operation returns the list of Operations for a Resource Provider
`Microsoft.RecoveryServices/locations/operationStatus/read`	Gets Operation Status for a given Operation
`Microsoft.RecoveryServices/Vaults/backupProtectionIntents/read`	List all backup Protection Intents
`Microsoft.Support/*`	Every operation under Microsoft.Support
`Microsoft.DataProtection/locations/getBackupStatus/action`	Check Backup Status for Recovery Services Vaults
`Microsoft.DataProtection/backupVaults/backupInstances/write`	Creates a Backup Instance
`Microsoft.DataProtection/backupVaults/backupInstances/delete`	Deletes the Backup Instance
`Microsoft.DataProtection/backupVaults/backupInstances/read`	Returns details of the Backup Instance
`Microsoft.DataProtection/backupVaults/deletedBackupInstances/read`	Get soft-deleted Backup Instance in a Backup Vault by name
`Microsoft.DataProtection/backupVaults/deletedBackupInstances/undelete/action`	Perform undelete of soft-deleted Backup Instance. Backup Instance moves from SoftDeleted to ProtectionStopped state.
`Microsoft.DataProtection/backupVaults/backupInstances/backup/action`	Performs Backup on the Backup Instance
`Microsoft.DataProtection/backupVaults/backupInstances/validateRestore/action`	Validates for Restore of the Backup Instance
`Microsoft.DataProtection/backupVaults/backupInstances/restore/action`	Triggers restore on the Backup Instance
`Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/crossRegionRestore/action`	Triggers cross region restore operation on given backup instance.
`Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/validateCrossRegionRestore/action`	Performs validations for cross region restore operation.
`Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJobs/action`	List cross region restore jobs of backup instance from secondary region.
`Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJob/action`	Get cross region restore job details from secondary region.
`Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchSecondaryRecoveryPoints/action`	Returns recovery points from secondary region for cross region restore enabled Backup Vaults.
`Microsoft.DataProtection/backupVaults/backupPolicies/write`	Creates Backup Policy
`Microsoft.DataProtection/backupVaults/backupPolicies/delete`	Deletes the Backup Policy
`Microsoft.DataProtection/backupVaults/backupPolicies/read`	Returns details of the Backup Policy
`Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read`	Returns details of the Recovery Point
`Microsoft.DataProtection/backupVaults/backupInstances/findRestorableTimeRanges/action`	Finds Restorable Time Ranges
`Microsoft.DataProtection/backupVaults/backupInstances/operationResults/read`	Returns Backup Operation Result for Backup Vault.
`Microsoft.DataProtection/backupVaults/write`	Create BackupVault operation creates an Azure resource of type 'Backup Vault'
`Microsoft.DataProtection/backupVaults/read`	The Get Backup Vault operation gets an object representing the Azure resource of type 'Backup Vault'
`Microsoft.DataProtection/backupVaults/operationResults/read`	Gets Operation Result of a Patch Operation for a Backup Vault
`Microsoft.DataProtection/backupVaults/operationStatus/read`	Returns Backup Operation Status for Backup Vault.
`Microsoft.DataProtection/locations/checkNameAvailability/action`	Checks if the requested BackupVault Name is Available
`Microsoft.DataProtection/locations/checkFeatureSupport/action`	Validates if a feature is supported
`Microsoft.DataProtection/locations/operationStatus/read`	Returns Backup Operation Status for Backup Vault.
`Microsoft.DataProtection/locations/operationResults/read`	Returns Backup Operation Result for Backup Vault.
`Microsoft.DataProtection/backupVaults/validateForBackup/action`	Validates for backup of Backup Instance
`Microsoft.DataProtection/operations/read`	Operation returns the list of Operations for a Resource Provider
`Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/delete`	The Delete ResourceGuard proxy operation deletes the specified Azure resource of type 'ResourceGuard proxy'
`Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/read`	Get ResourceGuard proxy operation gets an object representing the Azure resource of type 'ResourceGuard proxy'
`Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/unlockDelete/action`	Unlock delete ResourceGuard proxy operation unlocks the next delete critical operation
`Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/write`	Create ResourceGuard proxy operation creates an Azure resource of type 'ResourceGuard Proxy'
`Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/read`	Get the list of ResourceGuard proxies for a resource
`Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/write`	Create ResourceGuard proxy operation creates an Azure resource of type 'ResourceGuard Proxy'
`Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/delete`	The Delete ResourceGuard proxy operation deletes the specified Azure resource of type 'ResourceGuard proxy'

Showing 80 of 84.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Backup Contributor" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Backup Contributor" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '5e467623-bb1f-42f4-a55d-6e525e11384b')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5e467623-bb1f-42f4-a55d-6e525e11384b')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "5e467623-bb1f-42f4-a55d-6e525e11384b"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other storage roles

Azure File Sync Reader · 1 permission
Storage Blob Delegator · 1 permission
Storage File Data SMB Share Reader · 1 permission
Storage File Data SMB Take Ownership · 1 permission
Storage File Delegator · 1 permission
Storage Queue Data Message Sender · 1 permission
Storage Queue Delegator · 1 permission
Storage Table Delegator · 1 permission

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles