Guest Access for Azure Data Lake Gen 2

Question

Guest Access for Azure Data Lake Gen 2

Shaun Bailey 86

I have an ALDS Gen2 storage account that I need to share with a guest user. This user has an active Azure account, but it is outside of our domain. I've added them as a guest user in our Azure environment, but I cannot figure out how to share access to our blob container (and folder structure underneath).

I've followed several different how-to guides, but nothing seems to work. I could really use some step-by-step help!

Shaun Bailey 86 Reputation points

2023-08-01T14:22:42.69+00:00

Thank you @PRADEEPCHEEKATLA for the detailed answer! How about just a standard blob storage account? Is there a way to assign a guest user with a blob account instead?

Here's my scenario... One of our investors needs access to our archived data to be able to pull their own reports. He'll need access to a SQL database we've set up as well as a storage account. If he wants to use his Azure account on his tenant, how would I do that? I can set him up on our tenant as suggested, but his preference is to use his current tenant login as to limit the number of accounts he needs to maintain.
PRADEEPCHEEKATLA 90,651 Reputation points Moderator

2023-08-07T06:59:15.56+00:00

@Shaun Bailey - Just checking in to see if the below answer helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Accepted answer

0 additional answers

Your answer

Shaun Bailey 86 Reputation points

2023-08-01T14:22:42.69+00:00

Thank you @PRADEEPCHEEKATLA for the detailed answer! How about just a standard blob storage account? Is there a way to assign a guest user with a blob account instead?

Here's my scenario... One of our investors needs access to our archived data to be able to pull their own reports. He'll need access to a SQL database we've set up as well as a storage account. If he wants to use his Azure account on his tenant, how would I do that? I can set him up on our tenant as suggested, but his preference is to use his current tenant login as to limit the number of accounts he needs to maintain.
PRADEEPCHEEKATLA 90,651 Reputation points Moderator

2023-08-07T06:59:15.56+00:00

@Shaun Bailey - Just checking in to see if the below answer helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 1

PRADEEPCHEEKATLA 90,651 Moderator

@Shaun Bailey - Thanks for the question and using MS Q&A platform.

This is a limitation by design that ADLS Gen2 only support AD users from the same tenant. So a guest user cannot be added.

Azure Data Lake Storage Gen2 (ADLS Gen2) does not directly support Azure Active Directory (Azure AD) guest users for access control. ADLS Gen2 relies on Azure AD for authentication and access control, but it primarily works with users who are part of the same Azure AD tenant or directory as the storage account.

To provide access to users from outside your Azure AD tenant, such as guest users, you typically need to set up a mechanism to delegate access through a service account or use Shared Access Signatures (SAS) for temporary access.

For example, if you want to provide access to a guest user, you might create an Azure AD service account that has the necessary permissions to access the ADLS Gen2 storage. Then, you can share the credentials of this service account with the guest user to allow them to access the data.

For more details, refer to Access control model in Azure Data Lake Storage Gen2.

Hope this helps. Do let us know if you any further queries.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Shaun Bailey 86 Reputation points

2023-08-01T14:22:48.87+00:00

Thank you @PRADEEPCHEEKATLA for the detailed answer! How about just a standard blob storage account? Is there a way to assign a guest user with a blob account instead?

Here's my scenario... One of our investors needs access to our archived data to be able to pull their own reports. He'll need access to a SQL database we've set up as well as a storage account. If he wants to use his Azure account on his tenant, how would I do that? I can set him up on our tenant as suggested, but his preference is to use his current tenant login as to limit the number of accounts he needs to maintain.
PRADEEPCHEEKATLA 90,651 Reputation points Moderator

2023-08-03T06:18:40.9033333+00:00

@Shaun Bailey - In order to grant permission to the Guest user, here is third-party articles which explains how to provide guest user access to storage account:
https://support.templafy.com/hc/en-us/articles/360007546438-Provide-Guest-User-Read-Access-to-a-Storage-Account

https://blog.nillsf.com/index.php/2019/12/20/sharing-blob-storage-with-azure-ad-b2b-guests/

Disclaimer: This response contains a reference to a third-party World Wide Web site. Microsoft is providing this information as a convenience to you. Microsoft does not control these sites and has not tested any software or information found on these sites; therefore, Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. There are inherent dangers in the use of any software found on the Internet, and Microsoft cautions you to make sure that you completely understand the risk before retrieving any software from the Internet.
PRADEEPCHEEKATLA 90,651 Reputation points Moderator

2023-08-09T09:35:30.2966667+00:00

@Shaun Bailey - Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Share via

Guest Access for Azure Data Lake Gen 2

0 additional answers

Your answer