AzRoleAdvertizer

last sync: 2025-Oct-31 18:22:44 UTC

Backup Contributor

Azure BuiltIn RBAC Role definition

NameBackup Contributor
Microsoft Learn
Id5e467623-bb1f-42f4-a55d-6e525e11384b
DescriptionLets you manage backups, but can't delete vaults and give access to others
CategoryStorage
Microsoft Learn
CreatedOn2017-01-03 13:12:15 UTC
UpdatedOn2025-10-28 15:14:12 UTC
Permissions summary Effective control plane and data plane operations: 188 (unique operations)
•action: 53
•delete: 11
•read: 103
•write: 21

Actions: 89
Resolved control plane operations from Actions: 188
Effective control plane operations: 188
•action: 53
•delete: 11
•read: 103
•write: 21

NotActions: 0
Resolved control plane operations from NotActions: 0
Effective denied control plane operations: 17245

DataActions: 0
Resolved data plane operations: 0
Effective data plane operations: 0

NotDataActions: 0
Resolved data plane operations from NotDataActions: 0
Effective denied data plane operations: 4078
Actions
Operation Description
Microsoft.Authorization/*/readwildcarded / no description
Microsoft.DataProtection/backupVaults/backupInstances/backup/actionPerforms Backup on the Backup Instance
Microsoft.DataProtection/backupVaults/backupInstances/deleteDeletes the Backup Instance
Microsoft.DataProtection/backupVaults/backupInstances/findRestorableTimeRanges/actionFinds Restorable Time Ranges
Microsoft.DataProtection/backupVaults/backupInstances/operationResults/readReturns Backup Operation Result for Backup Vault.
Microsoft.DataProtection/backupVaults/backupInstances/readReturns all Backup Instances
Microsoft.DataProtection/backupVaults/backupInstances/readReturns all Backup Instances
Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/readReturns all Recovery Points
Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/readReturns all Recovery Points
Microsoft.DataProtection/backupVaults/backupInstances/restore/actionTriggers restore on the Backup Instance
Microsoft.DataProtection/backupVaults/backupInstances/resumeProtection/actionResume protection of a ProtectionStopped BI.
Microsoft.DataProtection/backupVaults/backupInstances/SuspendBackups/actionSuspend Backups operation stops only backups of backup instance. Retention activities will continue and hence data will be ratained as per policy.
Microsoft.DataProtection/backupVaults/backupInstances/validateForModifyBackup/actionValidates for modification of Backup Instance
Microsoft.DataProtection/backupVaults/backupInstances/validateRestore/actionValidates for Restore of the Backup Instance
Microsoft.DataProtection/backupVaults/backupInstances/writeCreates a Backup Instance
Microsoft.DataProtection/backupVaults/backupPolicies/deleteDeletes the Backup Policy
Microsoft.DataProtection/backupVaults/backupPolicies/readReturns all Backup Policies
Microsoft.DataProtection/backupVaults/backupPolicies/readReturns all Backup Policies
Microsoft.DataProtection/backupVaults/backupPolicies/writeCreates Backup Policy
Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/deleteThe Delete ResourceGuard proxy operation deletes the specified Azure resource of type 'ResourceGuard proxy'
Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/readGet ResourceGuard proxy operation gets an object representing the Azure resource of type 'ResourceGuard proxy'
Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/unlockDelete/actionUnlock delete ResourceGuard proxy operation unlocks the next delete critical operation
Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/writeCreate ResourceGuard proxy operation creates an Azure resource of type 'ResourceGuard Proxy'
Microsoft.DataProtection/backupVaults/deletedBackupInstances/readList soft-deleted Backup Instances in a Backup Vault.
Microsoft.DataProtection/backupVaults/deletedBackupInstances/undelete/actionPerform undelete of soft-deleted Backup Instance. Backup Instance moves from SoftDeleted to ProtectionStopped state.
Microsoft.DataProtection/backupVaults/operationResults/readGets Operation Result of a Patch Operation for a Backup Vault
Microsoft.DataProtection/backupVaults/operationStatus/readReturns Backup Operation Status for Backup Vault.
Microsoft.DataProtection/backupVaults/readGets list of Backup Vaults in a Resource Group
Microsoft.DataProtection/backupVaults/readGets list of Backup Vaults in a Resource Group
Microsoft.DataProtection/backupVaults/readGets list of Backup Vaults in a Resource Group
Microsoft.DataProtection/backupVaults/validateForBackup/actionValidates for backup of Backup Instance
Microsoft.DataProtection/backupVaults/writeUpdate BackupVault operation updates an Azure resource of type 'Backup Vault'
Microsoft.DataProtection/locations/checkFeatureSupport/actionValidates if a feature is supported
Microsoft.DataProtection/locations/checkNameAvailability/actionChecks if the requested BackupVault Name is Available
Microsoft.DataProtection/locations/getBackupStatus/actionCheck Backup Status for Recovery Services Vaults
Microsoft.DataProtection/locations/operationResults/readReturns Backup Operation Result for Backup Vault.
Microsoft.DataProtection/locations/operationStatus/readReturns Backup Operation Status for Backup Vault.
Microsoft.DataProtection/operations/readOperation returns the list of Operations for a Resource Provider
Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/crossRegionRestore/actionTriggers cross region restore operation on given backup instance.
Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJob/actionGet cross region restore job details from secondary region.
Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJobs/actionList cross region restore jobs of backup instance from secondary region.
Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchSecondaryRecoveryPoints/actionReturns recovery points from secondary region for cross region restore enabled Backup Vaults.
Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/validateCrossRegionRestore/actionPerforms validations for cross region restore operation.
Microsoft.Network/virtualNetworks/readGet the virtual network definition
Microsoft.RecoveryServices/locations/*wildcarded / no description
Microsoft.RecoveryServices/locations/backupPreValidateProtection/actionno description given
Microsoft.RecoveryServices/locations/backupStatus/actionCheck Backup Status for Recovery Services Vaults
Microsoft.RecoveryServices/locations/backupValidateFeatures/actionValidate Features
Microsoft.RecoveryServices/locations/operationStatus/readGets Operation Status for a given Operation
Microsoft.RecoveryServices/operations/readOperation returns the list of Operations for a Resource Provider
Microsoft.RecoveryServices/Vaults/backupconfig/*wildcarded / no description
Microsoft.RecoveryServices/Vaults/backupEngines/readReturns all the backup management servers registered with vault.
Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/*wildcarded / no description
Microsoft.RecoveryServices/Vaults/backupFabrics/operationResults/*wildcarded / no description
Microsoft.RecoveryServices/Vaults/backupFabrics/protectableContainers/readGet all protectable containers
Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/*wildcarded / no description
Microsoft.RecoveryServices/Vaults/backupFabrics/refreshContainers/actionRefreshes the container list
Microsoft.RecoveryServices/Vaults/backupJobs/*wildcarded / no description
Microsoft.RecoveryServices/Vaults/backupJobsExport/actionExport Jobs
Microsoft.RecoveryServices/Vaults/backupOperationResults/*wildcarded / no description
Microsoft.RecoveryServices/Vaults/backupOperations/readReturns Backup Operation Status for Recovery Services Vault.
Microsoft.RecoveryServices/Vaults/backupPolicies/*wildcarded / no description
Microsoft.RecoveryServices/Vaults/backupProtectableItems/*wildcarded / no description
Microsoft.RecoveryServices/Vaults/backupProtectedItems/*wildcarded / no description
Microsoft.RecoveryServices/Vaults/backupProtectionContainers/*wildcarded / no description
Microsoft.RecoveryServices/Vaults/backupProtectionIntents/readList all backup Protection Intents
Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/deleteThe Delete ResourceGuard proxy operation deletes the specified Azure resource of type 'ResourceGuard proxy'
Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/readGet the list of ResourceGuard proxies for a resource
Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/unlockDelete/actionUnlock delete ResourceGuard proxy operation unlocks the next delete critical operation
Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/writeCreate ResourceGuard proxy operation creates an Azure resource of type 'ResourceGuard Proxy'
Microsoft.RecoveryServices/Vaults/backupSecurityPIN/*wildcarded / no description
Microsoft.RecoveryServices/Vaults/backupstorageconfig/*wildcarded / no description
Microsoft.RecoveryServices/Vaults/backupUsageSummaries/readReturns summaries for Protected Items and Protected Servers for a Recovery Services .
Microsoft.RecoveryServices/Vaults/backupValidateOperation/actionValidate Operation on Protected Item
Microsoft.RecoveryServices/Vaults/certificates/*wildcarded / no description
Microsoft.RecoveryServices/Vaults/extendedInformation/*wildcarded / no description
Microsoft.RecoveryServices/Vaults/monitoringAlerts/readGets the alerts for the Recovery services vault.
Microsoft.RecoveryServices/Vaults/monitoringAlerts/writeResolves the alert.
Microsoft.RecoveryServices/Vaults/monitoringConfigurations/*wildcarded / no description
Microsoft.RecoveryServices/vaults/operationResults/readThe Get Operation Results operation can be used get the operation status and result for the asynchronously submitted operation
Microsoft.RecoveryServices/vaults/operationStatus/readGets Operation Status for a given Operation
Microsoft.RecoveryServices/Vaults/readThe Get Vault operation gets an object representing the Azure resource of type 'vault'
Microsoft.RecoveryServices/Vaults/registeredIdentities/*wildcarded / no description
Microsoft.RecoveryServices/Vaults/usages/*wildcarded / no description
Microsoft.RecoveryServices/Vaults/writeCreate Vault operation creates an Azure resource of type 'vault'
Microsoft.Resources/deployments/*wildcarded / no description
Microsoft.Resources/subscriptions/resourceGroups/readGets or lists resource groups.
Microsoft.Storage/storageAccounts/readReturns the list of storage accounts or gets the properties for the specified storage account.
Microsoft.Support/*wildcarded / no description
NotActions n/a
DataActions n/a
NotDataActions n/a
Used in
BuiltIn Policy
Policy DisplayName Policy Id Category State
[Preview]: Configure Azure Recovery Services vaults to disable public network access 04726aae-4e8d-427c-af7d-ecf56d490022 Backup Preview
[Preview]: Configure backup for Azure Disks (Managed Disks) with a given tag to an existing backup vault in the same region 7b5a3b1d-d2e1-4c0b-9f3b-ad0b9a2283f4 Backup Preview
[Preview]: Configure backup for Azure Disks (Managed Disks) without a given tag to an existing backup vault in the same region 6e68865f-f3cd-48ec-9bba-54795672eaa4 Backup Preview
[Preview]: Configure backup for Azure Files Shares with a given tag to a new recovery services vault with a new policy f32ca068-2ada-4705-b5b5-84ce89422846 Backup Preview
[Preview]: Configure backup for Azure Files Shares with a given tag to an existing recovery services vault in the same location d8659d5a-a3bd-444d-98ea-570bceb568cf Backup Preview
[Preview]: Configure backup for Azure Files Shares without a given tag to a new recovery services vault with a new policy 9e47cad9-bcdb-42dd-8c9b-a81e15ca2842 Backup Preview
[Preview]: Configure backup for Azure Files Shares without a given tag to an existing recovery services vault in the same location e159e079-0ddd-4905-97c9-79a8fca6d880 Backup Preview
[Preview]: Configure backup for blobs on storage accounts with a given tag to an existing backup vault in the same region 615b01c4-d565-4f6f-8c6e-d130268e3a1a Backup Preview
[Preview]: Configure blob backup for all storage accounts that do not contain a given tag to a backup vault in the same region 958dbd4e-0e20-4385-a082-d3f20c2a6ad8 Backup Preview
[Preview]: Disable Cross Subscription Restore for Azure Recovery Services vaults f19b0c83-716f-4b81-85e3-2dbf057c35d6 Backup Preview
[Preview]: Disable Cross Subscription Restore for Backup Vaults 4d479a11-f2b5-4f0a-bb1e-d2332aa95cda Backup Preview
Configure backup on virtual machines with a given tag to a new recovery services vault with a default policy 83644c87-93dd-49fe-bf9f-6aff8fd0834e Backup GA
Configure backup on virtual machines with a given tag to an existing recovery services vault in the same location 345fa903-145c-4fe1-8bcd-93ec2adccde8 Backup GA
Configure backup on virtual machines without a given tag to a new recovery services vault with a default policy 98d0b9f8-fd90-49c9-88e2-d3baf3b0dd86 Backup GA
Configure backup on virtual machines without a given tag to an existing recovery services vault in the same location 09ce66bc-1220-4153-8104-e3f51c936913 Backup GA
History
Date/Time (UTC ymd) (i) Change Change detail
2025-10-28 18:22:45 change: Actions Actions: 'add Microsoft.DataProtection/backupVaults/backupInstances/resumeProtection/action'
2025-01-27 19:31:07 change: Actions Actions: 'add Microsoft.DataProtection/backupVaults/backupInstances/validateForModifyBackup/action; add Microsoft.DataProtection/backupVaults/backupInstances/SuspendBackups/action'
2024-05-03 17:44:59 change: Description, Actions New Description: 'Lets you manage backups, but can't delete vaults and give access to others'
Old Description: 'Lets you manage backup service,but can't create vaults and give access to others',
Actions: 'add Microsoft.DataProtection/backupVaults/backupInstances/operationResults/read; add Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/delete; add Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/read; add Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/unlockDelete/action; add Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/write; add Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/read; add Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/write; add Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/delete; add Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/unlockDelete/action'
2023-05-19 17:43:13 change: Actions Actions: 'add Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/crossRegionRestore/action; add Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/validateCrossRegionRestore/action; add Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJobs/action; add Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJob/action; add Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchSecondaryRecoveryPoints/action'
2023-02-27 18:48:02 change: Actions Actions: 'add Microsoft.DataProtection/locations/checkFeatureSupport/action'
2023-02-17 18:39:13 change: Actions Actions: 'add Microsoft.RecoveryServices/vaults/operationStatus/read; add Microsoft.RecoveryServices/vaults/operationResults/read'
2022-10-14 16:34:33 change: Actions Actions: 'add Microsoft.DataProtection/backupVaults/operationStatus/read'
2022-09-28 16:34:30 change: Actions Actions: 'add Microsoft.DataProtection/backupVaults/deletedBackupInstances/read; add Microsoft.DataProtection/backupVaults/deletedBackupInstances/undelete/action'
2022-07-25 16:32:45 change: Actions Actions: 'remove Microsoft.DataProtection/providers/operations/read; add Microsoft.DataProtection/operations/read'
2021-06-14 13:58:52 change: Actions Actions: 'add Microsoft.DataProtection/locations/getBackupStatus/action; add Microsoft.DataProtection/backupVaults/backupInstances/write; add Microsoft.DataProtection/backupVaults/backupInstances/delete; add Microsoft.DataProtection/backupVaults/backupInstances/read; add Microsoft.DataProtection/backupVaults/backupInstances/read; add Microsoft.DataProtection/backupVaults/backupInstances/backup/action; add Microsoft.DataProtection/backupVaults/backupInstances/validateRestore/action; add Microsoft.DataProtection/backupVaults/backupInstances/restore/action; add Microsoft.DataProtection/backupVaults/backupPolicies/write; add Microsoft.DataProtection/backupVaults/backupPolicies/delete; add Microsoft.DataProtection/backupVaults/backupPolicies/read; add Microsoft.DataProtection/backupVaults/backupPolicies/read; add Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read; add Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read; add Microsoft.DataProtection/backupVaults/backupInstances/findRestorableTimeRanges/action; add Microsoft.DataProtection/backupVaults/write; add Microsoft.DataProtection/backupVaults/read; add Microsoft.DataProtection/backupVaults/operationResults/read; add Microsoft.DataProtection/locations/checkNameAvailability/action; add Microsoft.DataProtection/backupVaults/read; add Microsoft.DataProtection/backupVaults/read; add Microsoft.DataProtection/locations/operationStatus/read; add Microsoft.DataProtection/locations/operationResults/read; add Microsoft.DataProtection/backupVaults/validateForBackup/action; add Microsoft.DataProtection/providers/operations/read'
JSON
api-version=2023-07-01-preview
Condition none