AZ_STORAGE_BLOB_DATA_WRITER

Copy page

Summary


Forestall ACL Alias	AZ_STORAGE_BLOB_DATA_WRITER
Azure Alias	Storage Blob Data Writer
Affected Object Types	Storage Accounts / Blob Containers
Exploitation Certainty	Certain
Severity	High
Azure RBAC Roles	See Built-In Role Coverage below

Custom Role Data Actions:

Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write
Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete
Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action
Microsoft.Storage/storageAccounts/blobServices/containers/blobs/move/action
Microsoft.Storage/storageAccounts/blobServices/containers/blobs/*

Built-In Role Coverage

The edge implementation maps Azure RBAC roles that can modify blob data through DataActions. This includes content writes, adds, moves, deletes, tag writes, and privileged blob data operations. It does not include management-plane roles such as Owner unless they also grant blob data-plane actions directly.

Roles with direct blob modification data actions:

Avere Contributor (4f8fab4f-1852-4a58-a46a-8eaf358af14a) - blobs/delete, blobs/read, blobs/write.
Avere Operator (c025889f-8102-4ebf-b32c-fc0c6f0c6bd9) - blobs/delete, blobs/read, blobs/write.
Azure Red Hat OpenShift Image Registry Operator (8b32b316-c2f5-4ddf-b05b-83dacd2d08b5) - blobs/add/action, blobs/delete, blobs/move/action, blobs/read, blobs/write.
CosmosDB Fleet Analytics Storage Data Writer (bf41e52e-617f-4981-8b7a-47431bd4e011) - blobs/add/action, blobs/delete, blobs/read, blobs/write.
Defender for Storage Data Scanner (1e7ca9b1-60d1-4db8-a914-f2ca1ff27c40) - blobs/delete, blobs/read, blobs/tags/read, blobs/tags/write.
Defender Storage Automated Malware Remediation (c6c9b2d8-9a5e-4122-85e1-81612a046ab2) - blobs/delete.
Storage Actions Blob Data Operator (4bad4d9e-2a13-4888-94bb-c8432f6f3040) - blobs/add/action, blobs/delete, blobs/immutableStorage/runAsSuperUser/action, blobs/read, blobs/runAsSuperUser/action, blobs/tags/read, blobs/tags/write, blobs/write.
Storage Blob Data Contributor (ba92f5b4-2d11-453d-a403-e96b0029c9fe) - blobs/add/action, blobs/delete, blobs/move/action, blobs/read, blobs/write.
Storage Connector Contributor (9d819e60-1b9f-4871-b492-4e6cdee0b50a) - blobs/read, blobs/write.
VM Restore Operator (dfce8971-25e3-42e3-ba33-6055438e3080) - blobs/add/action, blobs/delete, blobs/read, blobs/write.

Roles with wildcard blob data actions that also cover blob modification:

Storage Blob Data Owner (b7e6dc6d-f1e8-4753-8033-0f276bb0955b) - includes Microsoft.Storage/storageAccounts/blobServices/containers/blobs/*.

Description

AZ_STORAGE_BLOB_DATA_WRITER represents data-plane permission to write, add, move, delete, update tags, or perform privileged operations against blob data in an Azure Storage Account. In addition to the read impact covered by AZ_STORAGE_BLOB_DATA_READER, this edge can let an attacker overwrite application content, replace deployment artifacts, delete evidence, stage payloads, or corrupt backups.

This edge is high impact because blob storage often feeds downstream workloads such as App Service deployments, Function packages, data pipelines, backup restoration, static websites, and containerized applications that pull configuration or content from storage.

Identification

PowerShell (Az Module)

Connect-AzAccount

$blobModifyDataActions = @(
    "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
    "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
    "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action",
    "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/move/action"
)

$blobModifyRoleDefinitions = Get-AzRoleDefinition | Where-Object {
    $hasMatch = $false

    foreach ($permission in $_.Permissions) {
        $grantedDataActions = @($permission.DataActions | Where-Object { $_ })
        $blockedDataActions = @($permission.NotDataActions | Where-Object { $_ })

        foreach ($targetAction in $blobModifyDataActions) {
            $isGranted = $false
            $isBlocked = $false

            foreach ($grantedAction in $grantedDataActions) {
                # Handle wildcards: *, Microsoft.Storage/*, etc.
                $pattern = "^" + [regex]::Escape($grantedAction).Replace("\*", ".*") + "$"
                if ($targetAction -match $pattern) { $isGranted = $true }
            }

            foreach ($blockedAction in $blockedDataActions) {
                $pattern = "^" + [regex]::Escape($blockedAction).Replace("\*", ".*") + "$"
                if ($targetAction -match $pattern) { $isBlocked = $true }
            }

            if ($isGranted -and -not $isBlocked) {
                $hasMatch = $true
                break
            }
        }
        if ($hasMatch) { break }
    }

    $hasMatch
}

$blobModifyRoleDefinitions |
    Select-Object Name, Id |
    Sort-Object Name |
    Format-Table -AutoSize

$blobModifyRoleIds = @(
    $blobModifyRoleDefinitions | ForEach-Object {
        ($_.Id.ToString() -split "/")[-1].ToLowerInvariant()
    }
)

$storageAccountScopes = Get-AzStorageAccount | Select-Object -ExpandProperty Id

$blobModifyAssignments = foreach ($scope in $storageAccountScopes) {
    Get-AzRoleAssignment -Scope $scope |
        Where-Object {
            $roleDefinitionId = ($_.RoleDefinitionId.ToString() -split "/")[-1].ToLowerInvariant()
            $blobModifyRoleIds -contains $roleDefinitionId
        } |
        Select-Object RoleDefinitionName, DisplayName, SignInName, ObjectType, Scope
}

$blobModifyAssignments |
    Select-Object RoleDefinitionName, DisplayName, SignInName, ObjectType, Scope |
    Sort-Object Scope, RoleDefinitionName |
    Format-Table -AutoSize

Exploitation

These examples are for authorized testing only.

Write Abuse

Upload new blobs or overwrite existing content. Use this to replace deployment artifacts, inject malicious payloads, or corrupt application data.

Azure CLI:

az login

az storage blob upload \
    --account-name "<AccountName>" \
    --container-name "<ContainerName>" \
    --name "<BlobName>" \
    --file ".\\payload.bin" \
    --overwrite true \
    --auth-mode login

PowerShell:

Connect-AzAccount

$ctx = New-AzStorageContext -StorageAccountName "<AccountName>" -UseConnectedAccount
Set-AzStorageBlobContent -Context $ctx -Container "<ContainerName>" -File ".\payload.bin" -Blob "<BlobName>" -Force

Delete Abuse

Delete blobs to destroy evidence, disrupt services, or corrupt backups.

Azure CLI:

az storage blob delete \
    --account-name "<AccountName>" \
    --container-name "<ContainerName>" \
    --name "<BlobName>" \
    --auth-mode login

PowerShell:

Connect-AzAccount

$ctx = New-AzStorageContext -StorageAccountName "<AccountName>" -UseConnectedAccount
Remove-AzStorageBlob -Context $ctx -Container "<ContainerName>" -Blob "<BlobName>"

Move Abuse

Move blobs between containers to exfiltrate data to an attacker-controlled container, bypass access controls, or disrupt workflows that depend on specific blob locations.

Azure CLI:

az storage blob copy start \
    --account-name "<AccountName>" \
    --destination-container "<DestContainerName>" \
    --destination-blob "<DestBlobName>" \
    --source-account-name "<AccountName>" \
    --source-container "<SourceContainerName>" \
    --source-blob "<SourceBlobName>" \
    --auth-mode login

az storage blob delete \
    --account-name "<AccountName>" \
    --container-name "<SourceContainerName>" \
    --name "<SourceBlobName>" \
    --auth-mode login

PowerShell:

Connect-AzAccount

$ctx = New-AzStorageContext -StorageAccountName "<AccountName>" -UseConnectedAccount
$sourceBlob = Get-AzStorageBlob -Context $ctx -Container "<SourceContainerName>" -Blob "<SourceBlobName>"
Start-AzStorageBlobCopy -SrcBlob $sourceBlob.Name -SrcContainer "<SourceContainerName>" -DestContainer "<DestContainerName>" -DestBlob "<DestBlobName>" -Context $ctx
Remove-AzStorageBlob -Context $ctx -Container "<SourceContainerName>" -Blob "<SourceBlobName>"

Mitigation

Limit write access - assign blob modification permissions only to identities that must modify data.
Scope assignments to containers instead of full storage accounts where possible.
Enable blob versioning and soft delete to recover from malicious overwrite or deletion.
Use immutable storage policies for backups, logs, and regulated data.
Separate deployment artifacts from general storage and protect production containers with stricter approval workflows.

Detection

Use the Azure Portal:

Open Azure Portal -> target Storage account -> Monitoring -> Logs.
Review StorageBlobLogs for write/delete operations such as PutBlob, PutBlockList, DeleteBlob, and SetBlobTier.
Alert on writes to production deployment containers, backup containers, or static website content by unusual principals.
Correlate blob writes with IAM changes, Microsoft Entra sign-in logs, and downstream workload restarts or deployments.
Review blob version history for unexpected replacements.

Ask AI

AZ_STORAGE_BLOB_DATA_WRITER

Summary

Built-In Role Coverage

Description

Identification

PowerShell (Az Module)

Azure Portal

Exploitation

Write Abuse

Delete Abuse

Move Abuse

Mitigation

Detection

References