Azure RBAC for

Hi Boris Zugic (Nokia),

Thanks for reaching out Microsoft Q&A,

• Azure Portal does not use data-plane RBAC when accessing blobs. Instead, it relies on storage account keys or a SAS generated from those keys. Because of this, only users with management-plane permissions such as Microsoft.Storage/storageAccounts/listKeys/action (e.g., Owner, Contributor, Storage Account Contributor) can browse, upload, and delete blobs in the Azure Portal.
• Users who have only data-plane roles (like Storage Blob Data Reader/Contributor) cannot interact with blobs in the portal UI, but they can access blobs programmatically using Azure AD authentication.
• Management-plane roles → Portal retrieves keys > full blob access in the UI.
• Data-plane roles only → Portal cannot get keys > no blob browsing in UI.
• Programmatic access (CLI/SDK) correctly uses data-plane RBAC(AAD) > works without keys.

Reference:

• Authorize access to blobs using Microsoft Entra ID - Azure Storage | Microsoft Learn
• Assign an Azure role for access to blob data - Azure Storage | Microsoft Learn

Please let us know if you have any further queries. I’m happy to assist you further.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Your understanding of how Azure Storage RBAC interacts with the Azure Portal UI is mostly correct. Here are the key points:

1. Management-plane roles: Users with roles like Owner or Contributor can perform blob operations in the Azure Portal, even if they do not have data-plane roles such as Storage Blob Data Reader or Contributor. This is because these management-plane roles allow access to the storage account keys, which are necessary for operations in the portal.
2. Data-plane roles: Users with only data-plane roles (e.g., Storage Blob Data Reader) cannot browse or interact with blobs in the Azure Portal UI. However, they can still access blobs programmatically using Microsoft Entra ID authentication, as they have the necessary permissions for data access.
3. Authorization mechanism: The Azure Portal checks for the Microsoft.Storage/storageAccounts/listKeys/action permission, which is part of the management-plane roles. If a user has this permission, the portal can use the storage account keys to perform blob operations. The portal does not check for data-plane roles when performing these operations.

Thus, your conclusion that the Azure Portal does not check data-plane roles and relies on management-plane roles with the appropriate permissions to perform blob operations is accurate.