Permissions required for Azure

Here is a custom role definition (in JSON format) that is required for the discovery, backup, restore, and authentication of the Microsoft Azure object store. You must associate a custom role with these permissions that the NetBackup users can use to work with Azure blob. To use Service principal or Managed identity authentication you need a role with the following permissions.

{
    "properties": {
        "roleName": "cosp_minimal",
        "description": "minimal permission required for cos protection.",
        "assignableScopes": [
            "/subscriptions/<Subsfription_ID>"
        ],
        "permissions": [
            {
                "actions": [
                    "Microsoft.Storage/storageAccounts/blobServices/read",
                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
                    "Microsoft.Storage/storageAccounts/blobServices/containers/write",
                    "Microsoft.ApiManagement/service/*",
                    "Microsoft.Authorization/*/read",
                    "Microsoft.Resources/subscriptions/resourceGroups/read",
                   "Microsoft.Storage/storageAccounts/read"

                ],
                "notActions": [],
                "dataActions": [
                    "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/filter/action",
                    "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/read",
                    "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/write",
                    "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
                    "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",

                ],
                "notDataActions": []
            }
        ]
    }
}