Skip to content

Commit 015a30a

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #307943 from rolyon/rolyon-rbac-roles-storage-file-data-smb-admin
[Azure RBAC] Storage File Data SMB Admin role
2 parents 213b874 + d3490a5 commit 015a30a

3 files changed

Lines changed: 53 additions & 0 deletions

File tree

‎articles/role-based-access-control/built-in-roles.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,7 @@ The following table provides a brief description of each built-in role. Click th
137137
> | <a name='storage-blob-delegator'></a>[Storage Blob Delegator](./built-in-roles/storage.md#storage-blob-delegator) | Get a user delegation key, which can then be used to create a shared access signature for a container or blob that is signed with Azure AD credentials. For more information, see [Create a user delegation SAS](/rest/api/storageservices/create-user-delegation-sas). | db58b8e5-c6ad-4a2a-8342-4190687cbf4a |
138138
> | <a name='storage-file-data-privileged-contributor'></a>[Storage File Data Privileged Contributor](./built-in-roles/storage.md#storage-file-data-privileged-contributor) | Allows for read, write, delete, and modify ACLs on files/directories in Azure file shares by overriding existing ACLs/NTFS permissions. This role has no built-in equivalent on Windows file servers. | 69566ab7-960f-475b-8e7c-b3118f30c6bd |
139139
> | <a name='storage-file-data-privileged-reader'></a>[Storage File Data Privileged Reader](./built-in-roles/storage.md#storage-file-data-privileged-reader) | Allows for read access on files/directories in Azure file shares by overriding existing ACLs/NTFS permissions. This role has no built-in equivalent on Windows file servers. | b8eda974-7b85-4f76-af95-65846b26df6d |
140+
> | <a name='storage-file-data-smb-admin'></a>[Storage File Data SMB Admin](./built-in-roles/storage.md#storage-file-data-smb-admin) | Allows for admin access equivalent to storage account key for end users over SMB. | bbf004e3-0e4b-4f86-ae4f-1f8fb47b357b |
140141
> | <a name='storage-file-data-smb-share-contributor'></a>[Storage File Data SMB Share Contributor](./built-in-roles/storage.md#storage-file-data-smb-share-contributor) | Allows for read, write, and delete access on files/directories in Azure file shares. This role has no built-in equivalent on Windows file servers. | 0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb |
141142
> | <a name='storage-file-data-smb-share-elevated-contributor'></a>[Storage File Data SMB Share Elevated Contributor](./built-in-roles/storage.md#storage-file-data-smb-share-elevated-contributor) | Allows for read, write, delete, and modify ACLs on files/directories in Azure file shares. This role is equivalent to a file share ACL of change on Windows file servers. | a7264617-510b-434b-a828-9731dc254ea7 |
142143
> | <a name='storage-file-data-smb-share-reader'></a>[Storage File Data SMB Share Reader](./built-in-roles/storage.md#storage-file-data-smb-share-reader) | Allows for read access on files/directories in Azure file shares. This role is equivalent to a file share ACL of read on Windows file servers. | aba4ae5f-2193-4029-9191-0cb91df5e314 |

‎articles/role-based-access-control/built-in-roles/storage.md‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1996,6 +1996,57 @@ Allows for read access on files/directories in Azure file shares by overriding e
19961996
}
19971997
```
19981998

1999+
## Storage File Data SMB Admin
2000+
2001+
Allows for admin access equivalent to storage account key for end users over SMB.
2002+
2003+
> [!div class="mx-tableFixed"]
2004+
> | Actions | Description |
2005+
> | --- | --- |
2006+
> | *none* | |
2007+
> | **NotActions** | |
2008+
> | *none* | |
2009+
> | **DataActions** | |
2010+
> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/fileServices/fileshares/files/read | Returns a file/folder or a list of files/folders |
2011+
> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/fileServices/fileshares/files/write | Returns the result of writing a file or creating a folder |
2012+
> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/fileServices/fileshares/files/delete | Returns the result of deleting a file/folder |
2013+
> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/fileServices/fileshares/files/modifypermissions/action | Returns the result of modifying permission on a file/folder |
2014+
> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/fileServices/readFileBackupSemantics/action | Read File Backup Semantics Privilege |
2015+
> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/fileServices/writeFileBackupSemantics/action | Write File Backup Semantics Privilege |
2016+
> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/fileServices/takeOwnership/action | File Take Ownership Privilege |
2017+
> | **NotDataActions** | |
2018+
> | *none* | |
2019+
2020+
```json
2021+
{
2022+
"assignableScopes": [
2023+
"/"
2024+
],
2025+
"description": "Allows for admin access equivalent to storage account key for end users over SMB.",
2026+
"id": "/providers/Microsoft.Authorization/roleDefinitions/bbf004e3-0e4b-4f86-ae4f-1f8fb47b357b",
2027+
"name": "bbf004e3-0e4b-4f86-ae4f-1f8fb47b357b",
2028+
"permissions": [
2029+
{
2030+
"actions": [],
2031+
"notActions": [],
2032+
"dataActions": [
2033+
"Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
2034+
"Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write",
2035+
"Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete",
2036+
"Microsoft.Storage/storageAccounts/fileServices/fileshares/files/modifypermissions/action",
2037+
"Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action",
2038+
"Microsoft.Storage/storageAccounts/fileServices/writeFileBackupSemantics/action",
2039+
"Microsoft.Storage/storageAccounts/fileServices/takeOwnership/action"
2040+
],
2041+
"notDataActions": []
2042+
}
2043+
],
2044+
"roleName": "Storage File Data SMB Admin",
2045+
"roleType": "BuiltInRole",
2046+
"type": "Microsoft.Authorization/roleDefinitions"
2047+
}
2048+
```
2049+
19992050
## Storage File Data SMB Share Contributor
20002051

20012052
Allows for read, write, and delete access on files/directories in Azure file shares. This role has no built-in equivalent on Windows file servers.

‎articles/role-based-access-control/whats-new.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ This article provides information about new features and documentation improveme
1818

1919
| Date | Area | Description |
2020
| --- | --- | --- |
21+
| November 2025 | Roles | Added [Storage File Data SMB Admin](./built-in-roles/storage.md#storage-file-data-smb-admin) role. |
2122
| October 2025 | Roles | Added [Log Analytics Data Reader](./built-in-roles/monitor.md#log-analytics-data-reader) role. |
2223
| October 2025 | Roles | Updated Azure permissions for Integration [Microsoft.Communication](./permissions/integration.md#microsoftcommunication) list. |
2324
| September 2025 | Roles | Added [Arc Gateway Manager](./built-in-roles/hybrid-multicloud.md#arc-gateway-manager) role.<br/>Added Azure Kubernetes Service Namespace roles.<br/>[Azure Kubernetes Service Namespace Contributor](./built-in-roles/containers.md#azure-kubernetes-service-namespace-contributor)<br/>[Azure Kubernetes Service Namespace User](./built-in-roles/containers.md#azure-kubernetes-service-namespace-user)<br>Added Azure Container Instances Contributor role.<br/>[Azure Container Instances Contributor Role](./built-in-roles/containers.md#azure-container-instances-contributor-role) |

0 commit comments

Comments
 (0)