What is the difference between Owner, Contributor and Reader?

Owner has full access including managing other users' access (role assignments). Contributor can create and manage all resource types but cannot grant access to others. Reader can only view resources. All three are management-plane roles and do not by themselves grant data-plane access like reading blob contents.

Why can a Contributor not read blob data?

Classic roles like Contributor and Owner act on the management plane — they manage the storage account itself. Reading or writing the actual blobs requires a data-plane role such as Storage Blob Data Reader or Storage Blob Data Contributor, which Azure separates so you can manage an account without seeing its contents.

What scopes can a role be assigned at?

Azure RBAC assignments apply at four scopes that inherit downward: management group, subscription, resource group and individual resource. Assigning a role at a resource group grants it on every resource inside, so prefer the narrowest scope a principal actually needs.

Which role lets someone manage access without managing resources?

User Access Administrator can manage role assignments (grant and revoke access) but not the resources themselves. It is the least-privilege way to delegate access management without giving full Owner rights over the resources.

How do I grant least-privilege Key Vault access?

Use the data-plane roles: Key Vault Secrets User to read secrets, Key Vault Secrets Officer to manage them, Key Vault Crypto User for key operations. The management role Key Vault Administrator covers all data operations but not the account's Azure resource settings.

What is the Azure RBAC Built-in Roles Reference?

Searchable Azure RBAC built-in role reference covering Owner, Contributor, Reader and service-specific roles for Storage, Key Vault, VMs and AKS with scope and assignment notes. It runs free in your browser on Gera Tools, with nothing uploaded.

Azure RBAC Built-in Roles Reference

Name: Azure RBAC Built-in Roles Reference
Creator: Gera Tools
License: https://creativecommons.org/licenses/by/4.0/

Get one useful tool a week

Like this tool? Enter your email and we'll send you one genuinely useful Gera tool a week — plus a link to come back to this one. No spam, one-click unsubscribe any time.

Azure RBAC built-in roles

Azure role-based access control (RBAC) grants access by assigning a role definition to a security principal (user, group, managed identity, or service principal) at a scope (management group, subscription, resource group, or individual resource). Built-in roles are Microsoft-maintained definitions that cover generic management (Owner, Contributor, Reader) and service-specific data access. This reference lists the most commonly used ones, their typical scope, and whether they act on the management or data plane.

Management plane vs data plane — the critical distinction

Azure separates two planes, and this is the most common source of least-privilege mistakes:

Plane	What it controls	Example roles
Management plane	The Azure resource object itself — create, configure, update, delete	Owner, Contributor, Reader
Data plane	The contents inside the resource — blobs, secrets, keys, messages	Storage Blob Data Contributor, Key Vault Secrets User

A user with Contributor on a storage account can create the account, change its settings, and view its access keys — but accessing the actual blobs requires a data-plane role like Storage Blob Data Contributor. This separation lets you manage infrastructure without ever touching the data it holds.

Scope inheritance

Assignments apply at a scope and inherit downward:

Management Group
  └── Subscription
        └── Resource Group
              └── Individual Resource

A role assigned at the resource group level is inherited by every resource inside that group. Always assign at the narrowest scope a principal actually needs.

How to assign a role

az role assignment create \
  --assignee [email protected] \
  --role "Storage Blob Data Reader" \
  --scope "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Storage/storageAccounts/<acct>"

To inspect what a role permits exactly:

az role definition list --name "Storage Blob Data Reader" --output json

Common role selection guide

Scenario	Recommended role
Full resource + access management	Owner
Create and manage resources, no access grants	Contributor
View resources only, no changes	Reader
Read blobs in a storage account	Storage Blob Data Reader
Read and write blobs	Storage Blob Data Contributor
Delegate access without managing resources	User Access Administrator
Read Key Vault secrets	Key Vault Secrets User
Manage Key Vault secrets (create, update, delete)	Key Vault Secrets Officer
Use cryptographic keys (sign, verify, encrypt)	Key Vault Crypto User
All Key Vault data operations	Key Vault Administrator
Deploy to AKS without cluster-admin	AKS Cluster User Role
View AKS cluster config	AKS Cluster Monitoring User

Common RBAC mistakes

Assigning Contributor at the subscription scope when only one resource group is needed — blast radius is much larger than intended.
Assuming Owner grants access to blob data — it does not; add a data-plane role separately.
Assigning a data-plane role expecting it to manage the resource configuration — data roles only cover contents, not resource settings.
Forgetting that role propagation can take a few minutes to replicate globally after assignment.

Search the reference below by role name or service to find the exact built-in role for your scenario.