Issue with Share permissions in "Set up a file share for MSIX app attach"

K. J. Skinner 181 Reputation points
2024-04-24T01:44:14.37+00:00

In the Unit 4 Set up a file share for MSIX app attach of Install and configure apps on a session host of the Manage user environments and apps for Azure Virtual Desktop, the instructions list to use "Storage File Data SMB Share Contributor" for the required role and then only "Read and Execute, Read, List folder contents." These will work fine for the shares and works as expected. However, this article is then used a basis for prep of asking what permission to use for the least privileged access for the delegated role and Storage File Data SMB Share Contributor & Storage File Data SMB Share Reader are both given as options. In this question, Storage File Data SMB Share Reader is the right answer because Read & Execute, and List Folder Contents are both allowed with a Read level share permission, but because it is using this step as the backing, the correct answer is marked as Contributor which is NOT the least privilege needed.

Azure Training
Azure Training
Azure: A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.Training: Instruction to develop new skills.
944 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Rakesh Gurram 2,920 Reputation points Microsoft Vendor
    2024-04-24T07:31:21.78+00:00

    Hi K. J. Skinner,

    Thanks for reaching out to us on the Microsoft Q&A forum.

    When we talk about the permissions available at the level of sharing, there are specific built-in roles that serve different purposes:

    1. Storage File Data SMB Share Reader: This role allows users to read files and directories in Azure file shares. It's similar to having 'read' access on Windows file servers, meaning users can view the contents without making changes.
    2. Storage Queue Data Contributor: This role grants users the ability to perform various actions on Azure Storage queues and messages within those queues. They can read, write, and delete messages as needed. For specific details on which actions are necessary for a particular data operation, you can refer to the Permissions for calling data operations documentation.

    Please refer to the following document and you can explore Share-level permissions further.

    Please don't hesitate to reach out to us if you have any further queries.

    If the information is helpful, please Accept Answer & Upvote so that it would be helpful to other community members.

    Thank you.

    0 comments