A credit-union vault team needs a custom role that can read blob da…

Question

A credit-union vault team needs a custom role that can read blob data inside a storage account but must not change the storage account resource itself. Where should those permission strings be placed in the custom role definition?

Accepted Answer

Put blob data-plane read operations in DataActions and keep account-management operations out of Actions — Control plane is the bank building; data plane is the safe deposit boxes. Account knobs go in Actions; reading blob bytes goes in DataActions. Mix those drawers and you either open the building or never reach the boxes.

Answer

Put blob reads in Actions and storage-account writes in NotDataActions to create an implicit deny

Answer

Put both control-plane and data-plane operations under Actions because DataActions is deprecated

Answer

Put blob reads in AssignableScopes and leave Actions empty so inheritance supplies data access

A credit-union vault team needs a custom role that can read blob data inside a storage account but must not change the storage account resource itself. Where should those permission strings be placed in the custom role definition?

Short Explanation

Full Explanation