Azure Files
An Azure service that offers file shares in the cloud.
1,425 questions
Assign NTFS permissions to folders in Azure Shares automatically
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(307.2, 78%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESA%3C/text%3E%3C/svg%3E)
Sebastian Astua
10
Reputation points
Hello
I am planning on migrating a NAS file share services currently on-prem to Azure File Shares. We currently use Service Now to enable a portal where users can go and add/remove themselves and others from the NTFS permissions table in the folders.
My question is: How can I automate this for my end users once we migrate to Azure Files? I am using Hybrid Identities and I can SSO from a client machine to a test shared folder I migrated, with the NTFS permissions included. I have read that you NEED a Windows client machine to mount the drive and configure NTFS permissions, but I need a solution to allow users to self-service themselves without requiring to mount the drive or traverse through the hierarchy and get lost
Is there a possibility with Power Automate or Logic Apps?
Azure Files
{count} votes
-
Sumarigo-MSFT 47,471 Reputation points Microsoft Employee Moderator2023-05-26T09:36:27.42+00:00 @Sebastian Astua Firstly, Apologies for the delay response! I am checking on this thread
-
Sebastian Astua 10 Reputation points
2023-05-31T05:20:43.27+00:00 Hi @Sumarigo-MSFT , any updates on this?
-
Sebastian Astua 10 Reputation points
2023-06-13T21:18:04.2833333+00:00 @Sumarigo-MSFT any news on this???
-
Luke Murray 11,436 Reputation points MVP Volunteer Moderator2023-06-13T21:30:09.77+00:00 Hi, Sebastian
Is this Azure FIles, or Azure FIle Sync?
- It is Azure File Sync, this should work, as it does today in your self-service solution - as the NTFS permissions will be replicated as part of the sync, as it does today, as long as your self-service solution is connecting to the on-prem fileserver.
- If its Azure FIles, then you may be able to do something with the icals command line tool - but you will need away of surfacing the folder structure (maybe a daily export to a text file, into a azure blob account, then surface that to a webinterface), or only offer a specific folder structure, and have the folder path as a parameter for icals.
I do wonder, if you could use icals to automatically assign NTFS permissions to an AAD group (run a container or windows VM that mounts the file structure each day and assigns the permissions), then all you need to do is add the users to the AAD group, but haven't dug too deep into that.
-
Sebastian Astua 10 Reputation points
2023-06-13T21:34:40.29+00:00 Thanks, it is with Azure File Shares (no sync involved as the idea is to decomission the existing service on prem). I didn´t want to mount the 70TB structure every day as it can be taxing and slow, besides inconvenient. I just find strange that there is no native support for this through Graph API
If building a CMDB with CIs is the solution, then probably we will not be able to migrate in the end -
Luke Murray 11,436 Reputation points MVP Volunteer Moderator
2023-06-13T21:43:09.4666667+00:00 I think the issue is the share/folder structure.
Just making huge assumptions, but if you can clean up the folder structure and move everything up a level or two, then you can use the SMB Azure RBAC permissions directly to grant people permissions at a share level.
Are there opportunities to move some of the files into SharePoint? Teams? Then people can join and request access to the teams directly, giving ownership of the business, then just access everything online or via Sync without having to look after the files.
70TB is a lot, so you may end up with a mix of day-to-day stuff in Teams/Sharepoint and more archive stuff in Azure File Shares.
Just some thoughts.
Sign in to comment
Sign in to answer