When creating a custom RBAC role that grants read access to an Azure Storage account, which property in the role definition must be configured?

The Actions[] property is where you define the specific operations that the role is allowed to perform. For read access to an Azure Storage account, you would include actions like Microsoft.Storage/storageAccounts/read or more granular read actions for blobs, files, queues, or tables. NotActions[] specifies operations that are explicitly excluded from the role, even if they are included in Actions[]. It's used for refining permissions, not defining them initially. DataActions[] is used for data plane operations, such as reading or writing data within a storage account (e.g., blob data). While relevant for storage, the question asks about read access to the storage account itself, which often involves control plane operations defined in Actions[] to view account properties. AssignableScopes[] defines the management group, subscription, or resource group scopes where the custom role can be assigned. It doesn't define what the role does, but rather where it can be used.