Azure Shared Disk Permissions and Visibility

Question

I have the following scenario:
I have one VM which has Azure Managed Disks created and attached to it. It is a shared disk i.e. "Enable shared disk" checked.

I additionally have Azure Virtual Desktop infrastructure. This shared disk is attached to AVD VMs.

Now the issue is:

1. Directories I create in that Disk from Azure VM is visible from my AVD Hosts but the directories I create from AVD Hosts are not visible from Azure VM (Disk is same i.e. shared)
2. I want to set the restrictions on folders that are created in that disk that won't allow delete operation for all users except Administrators. My users login to AVD Hosts via Entra ID Auth and are part of local Remote Desktop Users group present in AVD Host. Access is granted to users by using built-in roles i.e VM User Login and VM Administrator Login on the Resource Group Level.

How can I overcome both the issues? Priority being the first one for now.
Open for PowerShell script approach for 2nd issue as well.

Answer 1

Hi Arman Koradia, 

Welcome to Microsoft Q&A, thanks for posting your query.

Adding additional information for the above answer.

Yes, you can create an Azure File Share and mount it to both your VM and AVD hosting using the same drive letter across all systems. 

Here are few steps to set it up:

Create the Azure File Share:

Navigate to your Azure Storage Account >> File Shares, create a new file share, and note the connection string.

Azure Files provides SMB-based file shares that are ideal for scenarios where multiple VMs need simultaneous read/write access to the same file system, without requiring clustering software.

Mount the File Share on Each Host/VM:

Use PowerShell to mount it consistently with a specific drive letter (e.g., Z:). Example PowerShell command:

net use Z: \\<StorageAccountName>.file.core.windows.net\<FileShareName> /u:<StorageAccountName> <StorageAccountKey>

Replace "<StorageAccountName>", "<FileShareName>", and "<StorageAccountKey>" with your details. Run this on each VM/AVD Host to ensure they use the same drive letter.

Issue-2: 

Restricting Delete Permissions on folder:

To restrict delete permissions for all users except administrators, you can use PowerShell to set NTFS permissions on folders within the shared disks. This allows you to control access by denying delete permissions for the users and grants all the access permissions to administrator.

To adjust NTFS permissions use PowerShell:

Run the script on either the Azure VM or an AVD host where the shared disk is attached.

The script will remove delete permissions for all users, except the administrator group.

 

 # Set the path to the folder where delete restriction is needed
$folderPath = "D:\SharedFolder"  # Adjust path as necessary
# Get the current ACL (Access Control List) for the folder
$acl = Get-Acl -Path $folderPath
# Define a rule that denies delete permissions for all users
$denyRule = New-Object System.Security.AccessControl.FileSystemAccessRule(
    "Users",  # Adjust group as needed
    "Delete",
    "Deny"
)
# Add the deny rule to the ACL
$acl.SetAccessRule($denyRule)
# Define a rule that allows full control for administrators
$allowAdminRule = New-Object System.Security.AccessControl.FileSystemAccessRule(
    "Administrators", 
    "FullControl",
    "Allow"
)
# Add the allow rule for administrators to the ACL
$acl.SetAccessRule($allowAdminRule)
# Apply the updated ACL to the folder
Set-Acl -Path $folderPath -AclObject $acl
Write-Output "Permissions updated successfully on $folderPath"

This approach ensures that only administrators have the ability to delete folders on the shared disk, while standard users are restricted.

Run the Script as Administrator:

The PowerShell script should be run as an administrator to make sure that it has permissions to modify the ACL on the shared disk.

After running the script, verify that the users are still able to read and write to the disk but are unable to delete folders, while administrator has the full control.

Please feel free to contact if the issue persists, we will be glad to assist you closely. Please do consider clicking on "Accept Answer" and "Up-vote" on the post that helps you, as it can be beneficial to other community members.

Answer 2

Hi Arman,

I don't think shared disk is what you want for your use case. Shared disk is typically used for cluster workloads. For example, SQL Server Always On Failover Cluster Instance, Hyper-V failover cluster, scale-out file server, etc. You would install Failover clustering on the servers, create cluster, cluster shared volume, servers would all need to be same version, etc.

Windows Failover Clustering manages which node writes to the disk so there aren't problems. This is why you are having issues with directories/files being seen properly on the different servers.

As an alternative, have you considered creating a file share that you could access from the servers?

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP