Azure File Share - Read Only / Read Write access permissions

michal 186 Reputation points
2022-12-05T22:57:58.357+00:00

Hi all, trying to find out whether there is an option to configure RO or RW access to folders within a file share that is mapped to end user's computer.

Lets say... there is a file share called "SHARE" that is mapped to user using scrip generated in "Connect". There is FOLDER1 and FOLDER2 in that SHARE and I want to have user1 have RW to FOLDER1 and RO to FOLDER2.

....is it possible using Conditional access... or RBAC or similar?

I have a DC running in VM in Azure and using Azure AD Connect to sync users to AAD

Azure Files
Azure Files
An Azure service that offers file shares in the cloud.
1,163 questions
Azure Storage Accounts
Azure Storage Accounts
Globally unique resources that provide access to data management services and serve as the parent namespace for the services.
2,687 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Prrudram-MSFT 21,966 Reputation points
    2022-12-06T08:49:02.683+00:00

    Hello @michal ,

    Thank you for reaching out to the Microsoft Q&A platform. Happy to answer your question.

    Azure Files supports the full set of basic and advanced Windows ACLs.
    Before you configure Windows ACLs, you must first mount the file share by using your storage account key. To do so follow Mount the file share using your storage account key
    then proceed to configure Windows ACLs

    Details on required roles:
    You might see the Full Control ACL applied to a role already. This typically already offers the ability to assign permissions. However, because there are access checks at two levels (the share level and the file/directory level), this is restricted. Only users who have the SMB Elevated Contributor role and create a new file or directory can assign permissions on those new files or directories without using the storage account key. All other file/directory permission assignment requires connecting to the share using the storage account key first.
    For full details refer to https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-configure-permissions#azure-rbac-permissions

    Hope this helps.
    Please "Accept as Answer" and Upvote if the answer provided is useful, so that you can help others in the community looking for remediation for similar issues.

    0 comments