This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Hi folks,
How can I create or give the users additional permissions on my Storage Account SMB File share Read and Download access only?
I have assigned them access at the Resource Group and Storage Account level but it does not allow them to read and download the files under that SMB file share using the Storage Browser like below:
Reader
View all resources, but does not allow you to make any changes.
This resource
--
Reader and Data Access
Lets you view everything but will not let you delete or create a storage account or contained resource. It will also allow read/write access to all data contained in a storage account via access to storage account keys.
Parent resource (Inherited)
--
Storage File Data Privileged Reader
The customer has read access to Azure Storage file shares.
Parent resource (Inherited)
--
Storage File Data SMB Share Reader
Allows for read access to Azure File Share over SMB
This resource
Do I need to create a specific custom rule?
Hi,
Please assign the users Storage File Data SMB Share Reader role to the users at the scope of the file share (or at higher scope) and then test again.
Please click Accept Answer if the above was helpful.
Thanks.
-TP
Hi TP,
Yes, I did that, does it mean there are conflicting roles assigned from the below screenshot?
I re-read your original question and saw you are using Storage Browser. Unfortunately what you are attempting to do isn't going to work since Azure Files currently doesn't support RBAC over HTTP. Storage browser works for admins to access file shares since admins have access to the storage account access keys.
You don't want to grant regular users the ability to access the storage account access keys since that would give them full access to the account.
OK, so what’s the required roles I must clone and create ?
Hi TP,
Yes, that is what I've been trying to achieve, only allow the users to read and download the files in the SMB share only, nothing else.
I wonder how to achieve that ?
If you want to use RBAC, you need to use one of the supported scenarios, which you may not like and/or they may not fit your needs. You won't be able to have users use Storage Browser, so keep that in mind.
Please see article below for details:
Overview of Azure Files identity-based authentication options for SMB access
https://video2.skills-academy.com/en-us/azure/storage/files/storage-files-active-directory-overview
thank you for the confirmation :-)