What are the required RBAC permission required to restore and fetch deleted storage accounts?

Question

I was trying to restore a deleted storage account, on clicking on restore its displaying a message stating "We could not fetch the deleted storage accounts for the subscription". I have given Microsoft.Storage/storageAccounts/write and Microsoft.Storage/storageAccounts/read permission to the user, still the same error.

Answer 1

Hi,

To Restore deleted storage account the user needs:

Microsoft.Storage/deletedAccounts/read at Subscription level. You can create custom role for this. Please refer to this article if you are unfamiliar with creating custom role:

https://learn.microsoft.com/en-us/azure/active-directory/roles/custom-create

Storage Account Contributor on the resource group that the storage account was deleted from. If the resource group itself was deleted, you need to create a new one with the same name before attempting to restore. Perhaps you could grant a subset of the permissions of Storage Account Contributor, however, I know Storage Account Contributor works so if you want to be more granular you will need to research and test.

Thanks.

-TP

Answer 2

Hi,

To recover a deleted storage account there are some pre-conditions that needs to be met, so kindly check below list items and see if you fulfil these:

Also you can check this page for the detailed information on the recovery as it is not guranteed from Microsoft. The error doesnt seem to be RBAC or permissions issue. However you can check the permissions here.
storage-account-recover

Hope this helps.
JS

==
Please Accept the answer if the information helped you. This will help us and others in the community as well.