Azure Data Lake Storage
An Azure service that provides an enterprise-wide hyper-scale repository for big data analytic workloads and is integrated with Azure Blob Storage.
1,537 questions
How to control access to a folder in ADLS gen2 container while Storage account IAMs are in action
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(16, 74%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ES%3C/text%3E%3C/svg%3E)
SP
0
Reputation points
Hi,
I have a synapse pipeline that saves an output file in a folder (ex: salary) in an ADLS container (ex: employee). Now Mr. X wants the data saved in the folder to be accessible only to him but storage account level IAMs have already given access to many team members.
Is there a way to have the data saved in this container/storage account without meddling with the storage account level IAMs? If not, what would be the ideal solution?
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(304, 6%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EKD%3C/text%3E%3C/svg%3E)
Keshavulu Dasari 3,170 Reputation points Microsoft Vendor2025-02-03T19:41:20.19+00:00 Hi SP,
Greetings & Welcome to Microsoft Q&A forum! Thanks for posting your query!
To control access to a specific folder in an ADLS Gen2 container without changing the storage account level IAMs, you can use (ACLs). ACLs allow you to set fine-grained permissions at the directory and file level, which can help you restrict access to the "salary" folder for Mr. X.
Assign Reader Role at Storage Account/Container Level: Ensure that the security principals (users, groups, service principals) have at least the Reader role at the storage account or container level. This provides the necessary control plane permissions.
Set ACLs on the Folder:
- Navigate to the "salary" folder in the ADLS Gen2 container.
- Set the ACLs to grant Mr. X the required permissions (e.g., read, write) and remove or restrict permissions for other users.
Use Access ACLs: Apply Access ACLs to control access to the "salary" folder. These ACLs will determine who can read, write, or execute within the folder.
Default ACLs (Optional): If you want the permissions to be inherited by new files or subfolders created within the "salary" folder, set Default ACLs at the folder level.
To set ACLs:
- Navigate to the ADLS Gen2 container in the Azure portal.
- Select the "salary" folder.
- Click on "Access control (IAM)" and then "Add role assignment" to ensure Mr. X has the necessary Reader role.
- Go to the "Access Control Lists" (ACLs) tab.
- Add an entry for Mr. X with the desired permissions (e.g., read, write).
Remove or restrict permissions for other users as needed.To control access
If you are still facing issues, please provide some screenshots and details in the "comments" and I would be happy to help you.
Sign in to comment
Sign in to answer