// roles/azure · storage

Backup ReaderAzure built-in role

Can view backup services, but can't make changes

Role ID	`a795c7a0-d4a2-40c1-ae25-d81f01202912`
Category	Storage
Actions	60
Data actions	0

What it can do

Permission	What it allows
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.RecoveryServices/locations/allocatedStamp/read`	GetAllocatedStamp is internal operation used by service
`Microsoft.RecoveryServices/Vaults/backupFabrics/operationResults/read`	Returns status of the operation
`Microsoft.RecoveryServices/Vaults/backupFabrics/operationsStatus/read`	Returns status of the operation
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/operationResults/read`	Gets result of Operation performed on Protection Container.
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/operationResults/read`	Gets Result of Operation Performed on Protected Items.
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/operationsStatus/read`	Returns the status of Operation performed on Protected Items.
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/read`	Returns object details of the Protected Item
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/read`	Get Recovery Points for Protected Items.
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/read`	Returns all registered containers
`Microsoft.RecoveryServices/Vaults/backupJobs/operationResults/read`	Returns the Result of Job Operation.
`Microsoft.RecoveryServices/Vaults/backupJobs/read`	Returns all Job Objects
`Microsoft.RecoveryServices/Vaults/backupJobsExport/action`	Export Jobs
`Microsoft.RecoveryServices/Vaults/backupOperationResults/read`	Returns Backup Operation Result for Recovery Services Vault.
`Microsoft.RecoveryServices/Vaults/backupPolicies/operationResults/read`	Get Results of Policy Operation.
`Microsoft.RecoveryServices/Vaults/backupPolicies/read`	Returns all Protection Policies
`Microsoft.RecoveryServices/Vaults/backupProtectedItems/read`	Returns the list of all Protected Items.
`Microsoft.RecoveryServices/Vaults/backupProtectionContainers/read`	Returns all containers belonging to the subscription
`Microsoft.RecoveryServices/Vaults/backupUsageSummaries/read`	Returns summaries for Protected Items and Protected Servers for a Recovery Services .
`Microsoft.RecoveryServices/Vaults/extendedInformation/read`	The Get Extended Info operation gets an object's Extended Info representing the Azure resource of type ?vault?
`Microsoft.RecoveryServices/Vaults/monitoringAlerts/read`	Gets the alerts for the Recovery services vault.
`Microsoft.RecoveryServices/Vaults/read`	The Get Vault operation gets an object representing the Azure resource of type 'vault'
`Microsoft.RecoveryServices/Vaults/registeredIdentities/operationResults/read`	The Get Operation Results operation can be used get the operation status and result for the asynchronously submitted operation
`Microsoft.RecoveryServices/Vaults/registeredIdentities/read`	The Get Containers operation can be used get the containers registered for a resource.
`Microsoft.RecoveryServices/Vaults/backupstorageconfig/read`	Returns Storage Configuration for Recovery Services Vault.
`Microsoft.RecoveryServices/Vaults/backupconfig/read`	Returns Configuration for Recovery Services Vault.
`Microsoft.RecoveryServices/Vaults/backupOperations/read`	Returns Backup Operation Status for Recovery Services Vault.
`Microsoft.RecoveryServices/Vaults/backupPolicies/operations/read`	Get Status of Policy Operation.
`Microsoft.RecoveryServices/Vaults/backupEngines/read`	Returns all the backup management servers registered with vault.
`Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/read`	Get a backup Protection Intent
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/items/read`	Get all items in a container
`Microsoft.RecoveryServices/locations/backupStatus/action`	Check Backup Status for Recovery Services Vaults
`Microsoft.RecoveryServices/Vaults/monitoringConfigurations/*`	Every operation under Microsoft.RecoveryServices/Vaults/monitoringConfigurations
`Microsoft.RecoveryServices/Vaults/monitoringAlerts/write`	Resolves the alert.
`Microsoft.RecoveryServices/operations/read`	Operation returns the list of Operations for a Resource Provider
`Microsoft.RecoveryServices/locations/operationStatus/read`	Gets Operation Status for a given Operation
`Microsoft.RecoveryServices/Vaults/backupProtectionIntents/read`	List all backup Protection Intents
`Microsoft.RecoveryServices/Vaults/usages/read`	Returns usage details for a Recovery Services Vault.
`Microsoft.RecoveryServices/locations/backupValidateFeatures/action`	Validate Features
`Microsoft.RecoveryServices/locations/backupCrrJobs/action`	List Cross Region Restore Jobs in the secondary region for Recovery Services Vault.
`Microsoft.RecoveryServices/locations/backupCrrJob/action`	Get Cross Region Restore Job Details in the secondary region for Recovery Services Vault.
`Microsoft.RecoveryServices/locations/backupCrrOperationResults/read`	Returns CRR Operation Result for Recovery Services Vault.
`Microsoft.RecoveryServices/locations/backupCrrOperationsStatus/read`	Returns CRR Operation Status for Recovery Services Vault.
`Microsoft.DataProtection/locations/getBackupStatus/action`	Check Backup Status for Recovery Services Vaults
`Microsoft.DataProtection/backupVaults/backupInstances/read`	Returns details of the Backup Instance
`Microsoft.DataProtection/backupVaults/deletedBackupInstances/read`	Get soft-deleted Backup Instance in a Backup Vault by name
`Microsoft.DataProtection/backupVaults/backupPolicies/read`	Returns details of the Backup Policy
`Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read`	Returns details of the Recovery Point
`Microsoft.DataProtection/backupVaults/backupInstances/operationResults/read`	Returns Backup Operation Result for Backup Vault.
`Microsoft.DataProtection/backupVaults/backupInstances/findRestorableTimeRanges/action`	Finds Restorable Time Ranges
`Microsoft.DataProtection/backupVaults/read`	The Get Backup Vault operation gets an object representing the Azure resource of type 'Backup Vault'
`Microsoft.DataProtection/backupVaults/operationResults/read`	Gets Operation Result of a Patch Operation for a Backup Vault
`Microsoft.DataProtection/backupVaults/operationStatus/read`	Returns Backup Operation Status for Backup Vault.
`Microsoft.DataProtection/locations/operationStatus/read`	Returns Backup Operation Status for Backup Vault.
`Microsoft.DataProtection/locations/operationResults/read`	Returns Backup Operation Result for Backup Vault.
`Microsoft.DataProtection/operations/read`	Operation returns the list of Operations for a Resource Provider
`Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJobs/action`	List cross region restore jobs of backup instance from secondary region.
`Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJob/action`	Get cross region restore job details from secondary region.
`Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchSecondaryRecoveryPoints/action`	Returns recovery points from secondary region for cross region restore enabled Backup Vaults.
`Microsoft.DataProtection/locations/checkFeatureSupport/action`	Validates if a feature is supported

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Backup Reader" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Backup Reader" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, 'a795c7a0-d4a2-40c1-ae25-d81f01202912')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a795c7a0-d4a2-40c1-ae25-d81f01202912')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "a795c7a0-d4a2-40c1-ae25-d81f01202912"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other storage roles

Azure File Sync Reader · 1 permission
Storage Blob Delegator · 1 permission
Storage File Data SMB Share Reader · 1 permission
Storage File Data SMB Take Ownership · 1 permission
Storage File Delegator · 1 permission
Storage Queue Data Message Sender · 1 permission
Storage Queue Delegator · 1 permission
Storage Table Delegator · 1 permission

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles