azureblog.co.uk
← cd ~/roles
// roles/azure · compute

Data Operator for Managed DisksAzure built-in role

Provides permissions to upload data to empty managed disks, read, or export data of managed disks (not attached to running VMs) and snapshots using SAS URIs and Azure AD authentication.

Role ID959f8984-c045-4866-89c7-12bf9737be2e
CategoryCompute
Actions0
Data actions4

Before you assign it

  • It reaches the data, not just the resource. It has 4 data actions, such as reading blobs, secrets or messages.

What it can do

No control-plane actions.

Data actions

PermissionWhat it allows
Microsoft.Compute/disks/download/actionPerform read data operations on Disk SAS Uri
Microsoft.Compute/disks/upload/actionPerform write data operations on Disk SAS Uri
Microsoft.Compute/snapshots/download/actionPerform read data operations on Snapshot SAS Uri
Microsoft.Compute/snapshots/upload/actionPerform write data operations on Snapshot SAS Uri

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli
az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Data Operator for Managed Disks" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
powershell3 lines
New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Data Operator for Managed Disks" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
bicep7 lines
resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '959f8984-c045-4866-89c7-12bf9737be2e')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '959f8984-c045-4866-89c7-12bf9737be2e')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "959f8984-c045-4866-89c7-12bf9737be2e"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other compute roles

Find the smallest role for a task →

Sources