Azure NetApp Dual Protocol Permissions

Question

Azure NetApp Dual Protocol Permissions

Andrea Longhitano 100

Hello Everyone,

we have to configure an Azure NetApp with dual protocol (SMB + NFS).

We have created a volume with security style NTFS and the permissions are correctly handled using SMB and Windows.

I want to map the volume using NFS in linux virtual machine. How can I handle the permissions for local users in Unix? When we try to mount the volume, even with root permissions, we receive Permission Denied.

Thanks,

Andrea

Hari Babu Vattepally 3,025 Microsoft External Staff Moderator

Hi @Andrea Longhitano ,

While configuring an Azure NetApp volume with NTFS security style and accessing it via NFS, in this case you might face permissions issue due to the different permissions models of Windows and UNIX. Since your volume is set to NTFS, UNIX clients (like your Linux VM) cannot set attributes using NFS commands such as chown or chmod. So here permissions will be based on the NTFS ACLs.

In order to resolve the issue, please follow the below recommendations:

Please check that the Azure NetApp Files uses name mapping to translate Windows users to Unix users. Also, please check that the LDAP integration is correctly configured if using centralized authentication.

Please make sure that NFS clients cannot change permissions for the NTFS security style, and Windows clients cannot change permissions for UNIX-style dual-protocol volumes.

The following table describes the security styles and their effects:

Expand table

Security style	Clients that can modify permissions	Permissions that clients can use	Resulting effective security style	Clients that can access files
Unix	NFS	NFSv3 or NFSv4.1 mode bits	UNIX	NFS and Windows
`Unix`	NFS	NFSv3 or NFSv4.1 mode bits	UNIX	NFS and Windows
`Ntfs`	Windows	NTFS ACLs	NTFS	NFS and Windows

Apart from the above. If you are using AD, make sure to enable the option "Allow local NFS users with LDAP" in the AD connection settings. So that this will allow Unix users to access the volume without requiring LDAP authentication.

However, also make sure to check the export policy which allows access from your Linux VM. Please use cmd showmount -e <NetApp_IP> to list volumes. if the volume is not listed, update the export policy to allow access.

Alos, please try mounting with explicit NFS version and security options:

sudo mount -t nfs -o vers=4.1,sec=sys <NetApp_IP>:/<volume-path> /mnt/netapp

If you are using NFSv3 version, replace vers=4.1 with vers=3.

In case, if you need full permission control to Unix users. create a new volume with UNIX security style instead of NTFS. Because NTFS security style restricts Unix Clients from modifying permissions.

Also, please check that if the files are being used by Windows Users. Unix clients may not have access. So please use nfs4_getfacl and nfs4_setfacl to adjust permissions.

Please refer the below documents for more additional information:

Microsoft's guide on dual-protocol permissions.

how to create a dual-protocol volume.

I hope by following the above recommendations will help in resolving the issue.

Please let us know in the comments below, if the issue is resolved or still persists. We will be glad to assist you closely.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Andrea Longhitano 100 Reputation points

2025-05-05T12:30:06.08+00:00
I create a volume with NFSv3 & SMB protocol.

I create a local user user1 on a linux VM and configure the properties on AD as shown here that is reachable from the domain controller.

At the moment, no export policy are configured so everyone can access the Azure NetApp file so I can exclude connectivity issue.

The mount is done correctly with the command below.

sudo mount -t nfs -o vers=3,sec=sys <NetApp_IP>:/<volume-path> /mnt/netapp

However, when I try to type cd /mnt/netapp with the user user1 I receive the error Permission Denied.

Is there something else that I need to configure in the linux VM as a prerequisite?

Thanks,

Andrea
Mounika Reddy Anumandla 5,300 Reputation points Microsoft External Staff Moderator

2025-05-05T15:59:18.3133333+00:00

Hi Andrea Longhitano,

Since you're using Azure NetApp Files with dual protocol (NFSv3 + SMB) and the volume is set to NTFS security style, your "Permission Denied" error on Linux might be due to identity and access mapping.

Your Linux user (user1) is local

That user's UID (e.g., 1001) must match an AD user's uidNumber, and that AD user must have uidNumber and gidNumber. If the UID of the Linux user doesn't map to an AD identity with permissions on the NTFS ACLs, access is denied — even for root.

Hope it helps!

Let me know if you have any further queries!

If the information is helpful, please click "upvote" to let us know!
Hari Babu Vattepally 3,025 Reputation points Microsoft External Staff Moderator

2025-05-06T08:45:00.5933333+00:00

Hi @Andrea Longhitano ,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Venkatesan S 2,260 Reputation points Microsoft External Staff Moderator

2025-05-07T04:27:31.57+00:00

Hi @Andrea Longhitano

I wanted to follow up and see if the given answer was helpful. If this resolves your issue, please click “up-vote" for it, which could help other community members who read this thread. And, if you have any more questions, please let us know.

1 answer

Your answer

Andrea Longhitano 100 Reputation points

2025-05-05T12:30:06.08+00:00

I create a volume with NFSv3 & SMB protocol.

I create a local user user1 on a linux VM and configure the properties on AD as shown here that is reachable from the domain controller.

At the moment, no export policy are configured so everyone can access the Azure NetApp file so I can exclude connectivity issue.

The mount is done correctly with the command below.

sudo mount -t nfs -o vers=3,sec=sys <NetApp_IP>:/<volume-path> /mnt/netapp

However, when I try to type cd /mnt/netapp with the user user1 I receive the error Permission Denied.

Is there something else that I need to configure in the linux VM as a prerequisite?

Thanks,

Andrea
Mounika Reddy Anumandla 5,300 Reputation points Microsoft External Staff Moderator

2025-05-05T15:59:18.3133333+00:00

Hi Andrea Longhitano,

Since you're using Azure NetApp Files with dual protocol (NFSv3 + SMB) and the volume is set to NTFS security style, your "Permission Denied" error on Linux might be due to identity and access mapping.

Your Linux user (user1) is local

That user's UID (e.g., 1001) must match an AD user's uidNumber, and that AD user must have uidNumber and gidNumber. If the UID of the Linux user doesn't map to an AD identity with permissions on the NTFS ACLs, access is denied — even for root.

Hope it helps!

Let me know if you have any further queries!

If the information is helpful, please click "upvote" to let us know!
Hari Babu Vattepally 3,025 Reputation points Microsoft External Staff Moderator

2025-05-06T08:45:00.5933333+00:00

Hi @Andrea Longhitano ,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Venkatesan S 2,260 Reputation points Microsoft External Staff Moderator

2025-05-07T04:27:31.57+00:00

Hi @Andrea Longhitano

I wanted to follow up and see if the given answer was helpful. If this resolves your issue, please click “up-vote" for it, which could help other community members who read this thread. And, if you have any more questions, please let us know.

Answer 1

Andrea Longhitano 100

We found the issue.

The option Allow local NFS users with LDAP should be disabled as stated in the documentation.

Enabling "Allow local NFS users with LDAP" disables all LDAP translations of numeric IDs to user names. This action effectively breaks access to NTFS security style volumes. As such, use of this option with NTFS security style volumes is discouraged.

The documentation can be found here.

KarishmaTiwari-MSFT 20,762 Reputation points Microsoft Employee Moderator

2025-05-09T00:06:02.49+00:00

@Andrea Longhitano Thanks for sharing the update. Glad it was resolved. Let us know if you any other questions reagrding this.

Share via

Azure NetApp Dual Protocol Permissions

1 answer

Your answer