Troubleshooting ACL Issues for Azure AD Groups on Containers

Question

Why is access not granted to a user when added to a container's ACL via an Azure AD group?

PS - Based on common issues that we have seen from customers and other sources, we are posting these questions to help the Azure community.

Answer 1

The issue arises when a user, who is part of an Azure AD group, cannot access files in a container even though the group has been added to the container's ACL. Initially, the user was granted direct ACL permissions on the container and could access files using Storage Explorer. However, after removing the individual permissions and adding the Azure AD group to the ACL, the user encountered access errors.

During the investigation, it was identified that the Execute permission was missing in the ACLs. This permission is crucial for enabling access to the container's contents. To resolve this issue, add the Execute permission to the ACL and then verify the user's access again.

Resources:

• Authorize access to blobs using Microsoft Entra ID
• Access control lists (ACLs) in Azure Data Lake Storage Gen2
• Access control model in Azure Data Lake Storage Gen2
• Azure Blob Storage troubleshooting

Hope this helps. If you have any follow-up questions, please let me know. I would be happy to help.

Please do not forget to "Accept the answer" and "up-vote" wherever the information provided helps you, as this can be beneficial to other community members.