Azure Files - Read Only Access

Question

We have a M365/Entra ID environment. All users are setup in M365 (ie: fully cloud, we have no on-prem ADDS or Entra DS). We would like to give some users full access and other users read only access to an Azure File share? If we use the 'Access Keys' method to map a network drive, all users then have full access to the Azure File share. We have also tried mapping a drive (through Powershell), using a Shared Access Token, but this failed. When we look at enabling Identity Source on the Azure Storage Account, it suggests Entra ID isn't supported. Surely that cannot be right?

Answer 1

Hi @Philip Preece,

Greetings!

As mentioned above that, you would like to give some users full access and other users read only access to an Azure File share.

In order to achieve that, I would request you to follow the below steps:

Please Enable Microsoft Entra Domain Services authentication for your account.

Please keep in mind that you can enable Microsoft Entra Domain Services authentication over SMB only after you've successfully deployed Microsoft Entra Domain Services to your Microsoft Entra tenant. For more information, see the prerequisites.

Then by giving the share-level permission to the users this can resolved. You can use the Azure portal, Azure PowerShell, or Azure CLI to assign the built-in roles to the Microsoft Entra identity of a user for granting share-level permissions.

• Navigate to Portal and locate your Azure File share account
• On left panel Select Access Control (IAM) >> Click ADD to Add role assignment to the users.
• In the Add role assignment blade, select the appropriate built-in role from the Role list.
• To give full access to the Users assign Storage File Data SMB Share Elevated Contributor
• To give read-only access to Users, assign Storage File Data SMB Share Reader
• Leave Assign access to at the default setting: Microsoft Entra user, group, or service principal. Select the target Microsoft Entra identity by name or email address. The selected Microsoft Entra identity must be a hybrid identity and cannot be a cloud only identity**.** This means that the same identity is also represented in AD DS.
• Select Save to complete the role assignment operation.

For more information, please refer the below documents related to share-level permissions:

Share-level permissions for specific Microsoft Entra users or groups.

Access Azure file shares using Microsoft Entra ID with Azure Files OAuth over REST

Enable access to Azure file shares using OAuth over REST

However, as mentioned that you have even tried setting up by mapping network Drive. Here, you can use OAuth token to map the network drive instead of using access keys.

So, this will ensure that users authenticate with their Entra ID credentials and get the appropriate access level.

I hope by following the above steps, you should be able to assign different access level to users for your Azure File Share.

Please let us know if you have any further queries in comments sections. I’m happy to assist you further.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Answer 2

Hi Hari,

Thanks for the reply. We consciously decommissioned our on-prem ADDS servers and migrated fully into the cloud (ie: Entra ID / Azure AD). We don't want to reintroduce Active Directory Services again, be that 'Active Directory Domain Servers' or 'Entra Domain Services'. Is there any way to give Entra ID users access to Azure File shares without using ADDS or Entra DS and also gives us the ability to restrict permissions on a user or group basis?

Answer 3

Hi, i've applied the settings mentioned, however, when browsing to the Azure File Share path from File Explorer (ie: \storageaccountname.file.core.windows.net\sharename), it prompts for credentials over and over. The user credentials i'm using are correct and the user has IAM owner rights to the storage account. I've also temporarily tried excluding the user from our MFA conditional access policy. Any suggestions would be appreciated.