Restriction of specific folder in filing storage.

Question

Restriction of specific folder in filing storage.

Salman Farooq 35

Sir,

I have filing storage plan of azure. i have folders in my storage plan. how can i block specific folder in my storage plan for specific user. it is already assigned network drive for all users. Please if someone can help me in detail.

Regards,

Salman

1 answer

Your answer

Answer 1

Nandamuri Pranay Teja 3,610 Microsoft External Staff Moderator

Hello Salman Farooq

It would be possible to restrict access to certain folders within your Azure file share for certain users, even when the primary file share has been designated as a network drive for all users. This can be accomplished by utilizing the dual-layer permission model that Azure Files offers when employing identity-based authentication (such as Microsoft Entra Domain Services, which you have set up).

The user account you will use to set the NTFS permissions must have at least the "Storage File Data SMB Share Elevated Contributor" Azure RBAC role assigned at the storage account or file share scope. This role allows you to modify NTFS permissions on the file share.

Go to Azure Portal -> Your Storage Account -> Access control (IAM) -> Add role assignment.
Select Storage File Data SMB Share Elevated Contributor, select your admin user/group, and assign. Post which Log in to your domain-joined Windows VM using an Azure AD user account (the one you just assigned the RBAC role to).
Open File Explorer or a Command Prompt. Map the Azure file share as a network drive (e.g., Z: drive). You can do this using the net use command or through File Explorer's "Map network drive" option. Since identity-based authentication is set up, you should be able to map it using your Azure AD DS credentials without needing the storage account key.
```
  net use Z: \\<storageaccountname>.file.core.windows.net\<filesharename>
```
You won't need /user: or the key if your domain-joined VM and user are correctly configured with Azure AD DS authentication.

Once the network drive is mapped, open File Explorer and navigate to the root of your Azure file share (e.g., Z:\). Locate the specific folder you want to block access to (e.g., Z:\SecretProjectData).

Right-click on the folder and select "Properties".
Go to the "Security" tab.
Click **"**Edit..." to change permissions.
Click "Add..." to add a specific user or group.

Search for the Azure AD user(s) or Azure AD group(s) you want to block or grant specific permissions to. If these users/groups are synced from on-premises AD, ensure you're searching for their names as they appear in your domain-joined environment.

To block user/group add the user/group and for the user/group, in the "Permissions" box, check the "Deny" box next to "Full control". This will effectively deny them all access.

References:

Hope the above answer helps! Please let us know do you have any further queries.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

User's image

Nandamuri Pranay Teja 3,610 Reputation points Microsoft External Staff Moderator

2025-06-12T04:53:10.5+00:00

Hello Salman Farooq

Just checking in to see if the provided answer helped. If this answers your query, do click "Accept the answer” for the same, which might be beneficial to other community members reading this thread. And, if you have any further queries do let us know.
Salman Farooq 35 Reputation points

2025-06-12T06:48:23.92+00:00

I am getting this message.
Nandamuri Pranay Teja 3,610 Reputation points Microsoft External Staff Moderator

2025-06-12T07:28:21.04+00:00

Hello Salman Farooq

Thank you for the response!

The Windows VM you are using to browse the file share and set permissions must be domain-joined to the same Microsoft Entra Domain Services managed domain that your Azure storage account is integrated with. On the client VM, go to System Properties (search for "This PC" -> Right-click -> Properties -> Change settings). Verify that it shows as part of your domain. You must domain-join the Windows VM you're using to your Azure AD DS managed domain.

This error snip seems to have missing or misconfigured connection to your Active Directory Domain Services (AD DS) from the machine you're using to set the permissions. so, once your client VM is correctly domain-joined to your Azure AD DS and has clear network connectivity (including DNS resolution) to the AD DS domain controllers, you should be able to open the Security tab and manage NTFS permissions on your Azure file share folders without this error.

Hope the above answer helps! Please let us know do you have any further queries.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Salman Farooq 35 Reputation points

2025-06-12T07:44:28.3066667+00:00

Sir,

when i click on properties how to get change settings. I can see this:
Nandamuri Pranay Teja 3,610 Reputation points Microsoft External Staff Moderator

2025-06-12T08:05:45.1466667+00:00
Hello Salman Farooq

Thank you for the kind response!

Open "Run" dialog: Press Windows key + R on your keyboard. Type sysdm.cpl: In the "Run" dialog box, type sysdm.cpl and press Enter, or click "OK". This command directly opens the "System Properties" window. Once the "System Properties" window opens:

Go to the "Computer Name" tab.

Here, you will see your computer's full computer name, its workgroup or domain.

To change the settings (e.g., to join a domain or leave a domain), click the "Change..." button.

Hope the above answer helps! Please let us know do you have any further queries.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Share via

Restriction of specific folder in filing storage.

1 answer

Your answer