Can't apply ACL to folder in mounted Azure file share

Question

Can't apply ACL to folder in mounted Azure file share

C3 Fuels Azure Admin 0

I've created a security group via my Azure portal, but when I mount my Azure Files share and right click and select Properties\Security\Edit permissions\Add on a folder in that share I cannot add that security group. The Enter Network Credentials dialog keeps appearing and no account seems to work to get past that.

Hari Babu Vattepally 1,740 Reputation points Microsoft External Staff

2025-03-07T03:23:30.16+00:00
Hi @C3 Fuels Azure Admin ,

I understand that you are facing issues while applying ACLs to a folder in Mounted Azure File Share, particularly where you are not able to add a security group and repeatedly prompted for Network Credentials dialog.

The Enter Network Credentials dialog generally appears when the system cannot authenticate the user or group against the Azure File Share. Please make sure that you are using Identity based authentication and that the credentials are correct. which has permissions to access the Azure File Share.

Azure File Shares need share-level permissions to be assigned before you can apply directory or file-level ACLs. Ensure that the security group has been given the required share-level permissions, such as "Storage File Data SMB Share Contributor." You can assign the appropriate built-in role to your user to grant access the Azure file share.

If the security group is a "cloud-only" group (i.e.: it exists only in Microsoft Entra ID and isn't synced with Active Directory), it might not work for ACLs. Make sure the group is synced with Active Directory if you're using hybrid authentication.

If you are using Microsoft Entra Domain Services, please ensure that the client can communicate with the domain controllers in Azure. The client machine needs to have uninterrupted network connectivity to the domain controllers.

Please make sure you've assigned share-level permissions and configured directory and file-level permissions. Remember that share-level role assignment can take some time to take effect.

For additional reference, please follow the links:

Configure Windows ACLs

Mount the file share using your storage account key

Unable to mount Azure file shares with AD credentials

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Keshavulu Dasari 4,110 Reputation points Microsoft External Staff

2025-03-11T18:14:02.2266667+00:00

Hi C3 Fuels Azure Admin ,

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be glad to assist you.
C3 Fuels Azure Admin 0 Reputation points

2025-03-11T22:50:39.17+00:00

Hello,

Yes I am still having issues. I have verified that the Entra ID I use as credentials has the role of Storage File Data SMB Share Elevated Contributor - does this satisfy the Share-level Permissions?

1 answer

Your answer

Keshavulu Dasari 4,110 Reputation points Microsoft External Staff

2025-03-11T18:14:02.2266667+00:00

Hi C3 Fuels Azure Admin ,

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be glad to assist you.
C3 Fuels Azure Admin 0 Reputation points

2025-03-11T22:50:39.17+00:00

Hello,

Yes I am still having issues. I have verified that the Entra ID I use as credentials has the role of Storage File Data SMB Share Elevated Contributor - does this satisfy the Share-level Permissions?

Answer 1

Hi @C3 Fuels Azure Admin

To apply ACLs to a folder in a mounted Azure file share, you need to ensure that you are using the correct credentials and that the necessary permissions are assigned. Since you mentioned that your Entra ID has the role of Storage File Data SMB Share Elevated Contributor, this role should allow you to assign permissions on new files or directories created under that share and ensure assigned at share level permission.

If Entra ID Kerberos authentication is not set up, Windows might prompt for credentials. Ensure that Azure AD DS (Domain Services) or Hybrid AD Join is enabled for your environment.

If you intend to use a specific Microsoft Entra user or group to access Azure file share resources, that identity must be a hybrid identity that exists in both on-premises AD DS and Microsoft Entra ID. For example, say you have a user in your AD that is ******@onprem.contoso.com and you have synced to Microsoft Entra ID as ******@contoso.com using Microsoft Entra Connect Sync or Microsoft Entra Connect cloud sync. For this user to access Azure Files, you must assign the share-level permissions to ******@contoso.com. The same concept applies to groups and service principals.

Configure ACLs with icacls:

If your AD source is Microsoft Entra Domain Services, then <user-upn> will be <user-email>.

icacls <mapped-drive-letter>: /grant <user-upn>:(f)

Reference:

Check all the reference links I shared above; they will be useful, and you can resolve the issue by applying ACLs to your Azure file share.

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Share via

Can't apply ACL to folder in mounted Azure file share

1 answer

Your answer