// roles/azure · storage

Backup OperatorAzure built-in role

Lets you manage backup services, except removal of backup, vault creation and giving access to others

Role ID	`00c29273-979b-4161-815c-10b084fb9324`
Category	Storage
Actions	98
Data actions	0

What it can do

Permission	What it allows
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Network/virtualNetworks/read`	Get the virtual network definition
`Microsoft.RecoveryServices/Vaults/backupFabrics/operationResults/read`	Returns status of the operation
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/operationResults/read`	Gets result of Operation performed on Protection Container.
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/backup/action`	Performs Backup for Protected Item.
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/operationResults/read`	Gets Result of Operation Performed on Protected Items.
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/operationsStatus/read`	Returns the status of Operation performed on Protected Items.
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/read`	Returns object details of the Protected Item
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/provisionInstantItemRecovery/action`	Provision Instant Item Recovery for Protected Item
`Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/accessToken/action`	Get AccessToken for Cross Region Restore.
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/read`	Get Recovery Points for Protected Items.
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/restore/action`	Restore Recovery Points for Protected Items.
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/revokeInstantItemRecovery/action`	Revoke Instant Item Recovery for Protected Item
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/write`	Create a backup Protected Item
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/read`	Returns all registered containers
`Microsoft.RecoveryServices/Vaults/backupFabrics/refreshContainers/action`	Refreshes the container list
`Microsoft.RecoveryServices/Vaults/backupJobs/*`	Every operation under Microsoft.RecoveryServices/Vaults/backupJobs
`Microsoft.RecoveryServices/Vaults/backupJobsExport/action`	Export Jobs
`Microsoft.RecoveryServices/Vaults/backupOperationResults/*`	Every operation under Microsoft.RecoveryServices/Vaults/backupOperationResults
`Microsoft.RecoveryServices/Vaults/backupPolicies/operationResults/read`	Get Results of Policy Operation.
`Microsoft.RecoveryServices/Vaults/backupPolicies/read`	Returns all Protection Policies
`Microsoft.RecoveryServices/Vaults/backupProtectableItems/*`	Every operation under Microsoft.RecoveryServices/Vaults/backupProtectableItems
`Microsoft.RecoveryServices/Vaults/backupProtectedItems/read`	Returns the list of all Protected Items.
`Microsoft.RecoveryServices/Vaults/backupProtectionContainers/read`	Returns all containers belonging to the subscription
`Microsoft.RecoveryServices/Vaults/backupUsageSummaries/read`	Returns summaries for Protected Items and Protected Servers for a Recovery Services .
`Microsoft.RecoveryServices/Vaults/certificates/write`	The Update Resource Certificate operation updates the resource/vault credential certificate.
`Microsoft.RecoveryServices/Vaults/extendedInformation/read`	The Get Extended Info operation gets an object's Extended Info representing the Azure resource of type ?vault?
`Microsoft.RecoveryServices/Vaults/extendedInformation/write`	The Get Extended Info operation gets an object's Extended Info representing the Azure resource of type ?vault?
`Microsoft.RecoveryServices/Vaults/monitoringAlerts/read`	Gets the alerts for the Recovery services vault.
`Microsoft.RecoveryServices/Vaults/monitoringConfigurations/*`	Every operation under Microsoft.RecoveryServices/Vaults/monitoringConfigurations
`Microsoft.RecoveryServices/Vaults/read`	The Get Vault operation gets an object representing the Azure resource of type 'vault'
`Microsoft.RecoveryServices/Vaults/registeredIdentities/operationResults/read`	The Get Operation Results operation can be used get the operation status and result for the asynchronously submitted operation
`Microsoft.RecoveryServices/Vaults/registeredIdentities/read`	The Get Containers operation can be used get the containers registered for a resource.
`Microsoft.RecoveryServices/Vaults/registeredIdentities/write`	The Register Service Container operation can be used to register a container with Recovery Service.
`Microsoft.RecoveryServices/Vaults/usages/read`	Returns usage details for a Recovery Services Vault.
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Storage/storageAccounts/read`	Returns the list of storage accounts or gets the properties for the specified storage account.
`Microsoft.RecoveryServices/Vaults/backupstorageconfig/*`	Every operation under Microsoft.RecoveryServices/Vaults/backupstorageconfig
`Microsoft.RecoveryServices/Vaults/backupValidateOperation/action`	Validate Operation on Protected Item
`Microsoft.RecoveryServices/Vaults/backupTriggerValidateOperation/action`	Validate Operation on Protected Item
`Microsoft.RecoveryServices/Vaults/backupValidateOperationResults/read`	Validate Operation on Protected Item
`Microsoft.RecoveryServices/Vaults/backupValidateOperationsStatuses/read`	Validate Operation on Protected Item
`Microsoft.RecoveryServices/Vaults/backupOperations/read`	Returns Backup Operation Status for Recovery Services Vault.
`Microsoft.RecoveryServices/Vaults/backupPolicies/operations/read`	Get Status of Policy Operation.
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/write`	Creates a registered container
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/inquire/action`	Do inquiry for workloads within a container
`Microsoft.RecoveryServices/Vaults/backupEngines/read`	Returns all the backup management servers registered with vault.
`Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/write`	Create a backup Protection Intent
`Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/read`	Get a backup Protection Intent
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectableContainers/read`	Get all protectable containers
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/items/read`	Get all items in a container
`Microsoft.RecoveryServices/locations/backupStatus/action`	Check Backup Status for Recovery Services Vaults
`Microsoft.RecoveryServices/locations/backupPreValidateProtection/action`
`Microsoft.RecoveryServices/locations/backupValidateFeatures/action`	Validate Features
`Microsoft.RecoveryServices/locations/backupAadProperties/read`	Get AAD Properties for authentication in the third region for Cross Region Restore.
`Microsoft.RecoveryServices/locations/backupCrrJobs/action`	List Cross Region Restore Jobs in the secondary region for Recovery Services Vault.
`Microsoft.RecoveryServices/locations/backupCrrJob/action`	Get Cross Region Restore Job Details in the secondary region for Recovery Services Vault.
`Microsoft.RecoveryServices/locations/backupCrossRegionRestore/action`	Trigger Cross region restore.
`Microsoft.RecoveryServices/locations/backupCrrOperationResults/read`	Returns CRR Operation Result for Recovery Services Vault.
`Microsoft.RecoveryServices/locations/backupCrrOperationsStatus/read`	Returns CRR Operation Status for Recovery Services Vault.
`Microsoft.RecoveryServices/Vaults/monitoringAlerts/write`	Resolves the alert.
`Microsoft.RecoveryServices/operations/read`	Operation returns the list of Operations for a Resource Provider
`Microsoft.RecoveryServices/locations/operationStatus/read`	Gets Operation Status for a given Operation
`Microsoft.RecoveryServices/Vaults/backupProtectionIntents/read`	List all backup Protection Intents
`Microsoft.Support/*`	Every operation under Microsoft.Support
`Microsoft.DataProtection/backupVaults/backupInstances/read`	Returns details of the Backup Instance
`Microsoft.DataProtection/backupVaults/backupInstances/operationResults/read`	Returns Backup Operation Result for Backup Vault.
`Microsoft.DataProtection/backupVaults/backupInstances/write`	Creates a Backup Instance
`Microsoft.DataProtection/backupVaults/deletedBackupInstances/read`	Get soft-deleted Backup Instance in a Backup Vault by name
`Microsoft.DataProtection/backupVaults/backupPolicies/read`	Returns details of the Backup Policy
`Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read`	Returns details of the Recovery Point
`Microsoft.DataProtection/backupVaults/backupInstances/findRestorableTimeRanges/action`	Finds Restorable Time Ranges
`Microsoft.DataProtection/backupVaults/read`	The Get Backup Vault operation gets an object representing the Azure resource of type 'Backup Vault'
`Microsoft.DataProtection/backupVaults/operationResults/read`	Gets Operation Result of a Patch Operation for a Backup Vault
`Microsoft.DataProtection/backupVaults/operationStatus/read`	Returns Backup Operation Status for Backup Vault.
`Microsoft.DataProtection/locations/operationStatus/read`	Returns Backup Operation Status for Backup Vault.
`Microsoft.DataProtection/locations/operationResults/read`	Returns Backup Operation Result for Backup Vault.
`Microsoft.DataProtection/operations/read`	Operation returns the list of Operations for a Resource Provider
`Microsoft.DataProtection/backupVaults/validateForBackup/action`	Validates for backup of Backup Instance

Showing 80 of 98.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Backup Operator" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Backup Operator" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '00c29273-979b-4161-815c-10b084fb9324')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00c29273-979b-4161-815c-10b084fb9324')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "00c29273-979b-4161-815c-10b084fb9324"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other storage roles

Azure File Sync Reader · 1 permission
Storage Blob Delegator · 1 permission
Storage File Data SMB Share Reader · 1 permission
Storage File Data SMB Take Ownership · 1 permission
Storage File Delegator · 1 permission
Storage Queue Data Message Sender · 1 permission
Storage Queue Delegator · 1 permission
Storage Table Delegator · 1 permission

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles