An Azure service that is used to share data from multiple sources with other organizations.
Azure Data Share receiving scenarios are tied not only to the Data Share account but also to the destination resource where the shared data is received.
Received Shares are represented as Share Subscriptions, and Azure Data Share exposes dedicated permissions such as:
-
Microsoft.DataShare/accounts/read -
Microsoft.DataShare/accounts/shareSubscriptions/read -
Microsoft.DataShare/listInvitations/read
Azure Data Share also supports the use of custom RBAC roles, allowing organizations to implement a least-privilege access model instead of assigning broad built-in roles.
At this time, there is no documented built-in read-only role specifically for viewing Received Shares, nor is there a published minimum permission set that guarantees visibility of the Received Shares blade without the permissions required for the receive workflow.
If the requirement is to avoid assigning the Storage Account Contributor role, a possible approach would be to evaluate a custom role containing only the required Azure Data Share permissions and validate whether it satisfies the visibility requirement in your environment.
Helpful References:
https://learn.microsoft.com/en-us/azure/data-share/concepts-roles-permissions
https://learn.microsoft.com/en-us/azure/data-share/concepts-roles-permissions#custom-roles-for-data-share
https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles
https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/storage#microsoftdatashare
Please let us know if you have any questions.