Azure Files share maps but only gets the Default share-level permissions

Question

I have gone through the AzFilesHybrid setup as indicated for using the Active Directory Domain Services configuration and that all checks out fine as far as I can tell. I have the default share-level permissions set to Storage File Data SMB Share Reader since for at least this test environment I don't mind having the minimum access being read only. And then I have setup a non-administrative test user in the Access Control to have Storage File Data SMB Share Contributor role for the file share. I use the provided script for Active Directory or Microsoft Entra to map the drive to the letter Z and it successfully maps without issue. However, when I try to create a new file or folder I am given the message that I need permission to perform this action. If I change the default permissions to Share Contributor and disconnect the drive and re-run the connection script, then I can write to my heart's content. If I disable the share-level permissions entirely then I am unable to map the drive at all which tells me that the IAM Access Controls are doing nothing but I am unsure as to why. But at the same time if I try to map the drive logged into the computer as a local user it fails regardless of any of the above scenarios meaning that some sort of authentication must be taking place. I'm not sure if I missed a step somewhere or if there isn't something configured correctly somewhere else within our account. So how do I make the RBAC roles actually work on a synced AD?

Answer 1

Hello Brian Gawith,

Greetings! Welcome to Microsoft Q&A Platform.

 

In Azure Files, when you create a file share, you can configure both share-level and file/directory-level permissions. Share-level permissions apply to the entire file share, while file/directory-level permissions apply to specific files or directories within the share.  

To assign Azure Role-Based Access Control (RBAC) permissions for the Azure file share to a user group, you must create the group in Active Directory and sync it to Microsoft Entra ID. As per Azure documentation, "If you want to set share-level permissions for specific Microsoft Entra users or groups using Azure role-based access control (RBAC), then you must first sync the on-premises AD accounts to Microsoft Entra ID using Microsoft Entra Connect. Otherwise, you can use a default share-level permission."   https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-multiple-forests

Because computer accounts don't have an identity in Microsoft Entra ID, you can't configure Azure role-based access control (RBAC) for them. However, computer accounts can access a file share by using a default share-level permission.

https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-assign-permissions?tabs=azure-portal  

Based on your description, I understand that once you change the user default permissions to Share Contributor, you were able to successfully write in the file. This indicates that the issue might be with the permissions assigned to the specific users or groups. You can try assigning the required permissions to the specific users or groups and check if the issue is resolved.  

Also, IAM Access Controls are used to manage access to Azure resources and services. They are not related to Azure Files share permissions. If you are unsure about the access controls, please review the below Microsoft documentation Overview - Azure Files identity-based authentication | Microsoft Learn for guidance.  

Hope this answer helps! If yes please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Answer 2

I was able to get the RBAC role assignments to work when using an AD Synchronized group with the wanted users in that group and then the roles assigned to the group.