You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/storage/files/authorize-oauth-rest.md
+18-30Lines changed: 18 additions & 30 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,24 +15,14 @@ ms.custom:
15
15
16
16
# Access Azure file shares using Microsoft Entra ID with Azure Files OAuth over REST
17
17
18
+
:heavy_check_mark:**Applies to:** Classic file shares created with the Microsoft.Storage resource provider
19
+
20
+
:heavy_multiplication_x:**Doesn't apply to:** File shares created with the Microsoft.FileShares resource provider (preview)
21
+
18
22
By using Azure Files OAuth over REST, users and applications can get admin-level read and write access to Azure file shares through the [OAuth](https://oauth.net/) authentication protocol. This access method uses Entra ID for REST API based access. Users, groups, first-party services such as Azure portal, and third-party services and applications using REST interfaces can now use OAuth authentication and authorization with a Microsoft Entra account to access data in Azure Files. PowerShell cmdlets and Azure CLI commands that call REST APIs can also use OAuth to access Azure Files. You must call the REST API using an explicit header to indicate your intent to use the additional privilege. This requirement also applies to Azure PowerShell and Azure CLI access.
19
23
20
24
> [!IMPORTANT]
21
-
> This article explains how to enable admin-level access to Azure file shares for specific [customer use cases](#customer-use-cases). For a more general article on identity-based authentication for end users, see [Overview of Azure Files identity-based authentication for SMB access](storage-files-active-directory-overview.md).
22
-
23
-
## Applies to
24
-
| Management model | Billing model | Media tier | Redundancy | SMB | NFS |
> This article explains how to enable admin-level access to Azure file shares for specific [customer use cases](#customer-use-cases). For a more general article on identity-based authentication for end users, see [Overview of Azure Files identity-based authentication](storage-files-active-directory-overview.md).
36
26
37
27
## Limitations
38
28
@@ -72,12 +62,12 @@ To use the Azure Files OAuth over REST feature, include extra permissions in the
72
62
73
63
Users, groups, or service principals who call the REST API by using OAuth must have either the `readFileBackupSemantics` or `writeFileBackupSemantics` action assigned to the role that grants data access. This is a requirement to use this feature. For details on the permissions required to call specific File service operations, see [Permissions for calling data operations](/rest/api/storageservices/authorize-with-azure-active-directory#permissions-for-calling-data-operations).
74
64
75
-
This feature provides two built-in roles that include these new actions.
65
+
This feature provides two built-in roles that include these actions.
76
66
77
67
|**Role**|**Data actions**|
78
68
|----------|------------------|
79
-
| Storage File Data Privileged Reader |`Microsoft.Storage/storageAccounts/fileServices/fileShares/files/read`<br>`Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action`|
80
-
| Storage File Data Privileged Contributor |`Microsoft.Storage/storageAccounts/fileServices/fileShares/files/read`<br>`Microsoft.Storage/storageAccounts/fileServices/fileShares/files/write`<br>`Microsoft.Storage/storageAccounts/fileServices/fileShares/files/delete`<br>`Microsoft.Storage/storageAccounts/fileServices/writeFileBackupSemantics/action`<br>`Microsoft.Storage/storageAccounts/fileServices/fileshares/files/modifypermissions/action`|
69
+
|[Storage File Data Privileged Reader](../../role-based-access-control/built-in-roles.md#storage-file-data-privileged-reader)|`Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read`<br>`Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action`|
70
+
|[Storage File Data Privileged Contributor](../../role-based-access-control/built-in-roles.md#storage-file-data-privileged-contributor)|`Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read`<br>`Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write`<br>`Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete`<br>`Microsoft.Storage/storageAccounts/fileServices/writeFileBackupSemantics/action`<br>`Microsoft.Storage/storageAccounts/fileServices/fileshares/files/modifypermissions/action`|
81
71
82
72
These roles are similar to the [Storage File Data SMB Share Reader](../../role-based-access-control/built-in-roles.md#storage-file-data-smb-share-reader) and [Storage File Data SMB Share Elevated Contributor](../../role-based-access-control/built-in-roles.md#storage-file-data-smb-share-elevated-contributor) built-in roles, but there are some differences:
83
73
@@ -176,9 +166,9 @@ You can also authorize access to file data by using the Azure portal, Azure Powe
176
166
177
167
# [Azure portal](#tab/portal)
178
168
179
-
The [Azure portal](https://portal.azure.com?azure-portal=true) can use either your Entra account or the storage account access key to access file data in an Azure storage account. Which authorization scheme the Azure portal uses depends on the Azure roles that are assigned to you.
169
+
The [Azure portal](https://portal.azure.com?azure-portal=true) can use either your Entra account or the storage account access key to access file data in an Azure storage account. Which authorization method the Azure portal uses depends on the Azure roles that are assigned to you.
180
170
181
-
When you attempt to access file data, the Azure portal first checks whether you have an Azure role with `Microsoft.Storage/storageAccounts/listkeys/action`. If you have a role with this action, the Azure portal uses the account key for accessing file data via shared key authorization. If you don't have a role with this action, the Azure portal attempts to access data by using your Entra account.
171
+
When you attempt to access file data, the Azure portal first checks whether you have an Azure role with `Microsoft.Storage/storageAccounts/listkeys/action`. If you have a role with this action, the Azure portal uses the storage account key for accessing file data via shared key authorization. If you don't have a role with this action, the Azure portal attempts to access data by using your Entra account.
182
172
183
173
To access file data from the Azure portal by using your Entra account, you need permissions to access file data, and you also need permissions to navigate through the storage account resources in the Azure portal. The built-in roles provided by Azure grant access to file resources, but they don't grant permissions to storage account resources. For this reason, access to the portal also requires assigning an Azure Resource Manager (ARM) role such as the **Reader** role, scoped to the level of the storage account or higher. The **Reader** role grants the most restrictive permissions, but any ARM role that grants access to storage account management resources is acceptable.
184
174
@@ -202,17 +192,15 @@ The storage context with OAuth works only for operations on files and directorie
202
192
203
193
You need an Azure resource group and a storage account within that resource group. The storage account must be assigned a role that grants explicit permissions to perform data operations against file shares. Make sure that you have the required roles and permissions to access both the management services and data services. For details on the permissions required to call specific File service operations, see [Permissions for calling data operations](/rest/api/storageservices/authorize-with-azure-active-directory#permissions-for-calling-data-operations).
204
194
205
-
## Install Az.Storage module
206
-
207
-
This feature is available in the latest Az.Storage module. Install the module by using this command:
195
+
You also need to install the latest [Az.Storage](https://www.powershellgallery.com/packages/Az.Storage/) module:
208
196
209
197
```azurepowershell-interactive
210
198
Install-Module Az.Storage -Repository PsGallery
211
199
```
212
200
213
201
## Authorize access to file data
214
202
215
-
To authorize access to file data, follow these steps.
203
+
To authorize access to file data by using Azure PowerShell, follow these steps.
216
204
217
205
1. Sign in to your Azure account by using the `Connect-AzAccount` cmdlet.
218
206
@@ -262,11 +250,11 @@ All commands under the `az storage file` and `az storage directory` command grou
262
250
263
251
You need an Azure resource group and a storage account within that resource group. The storage account must be assigned a role that grants explicit permissions to perform data operations against file shares. Make sure that you have the required roles and permissions to access both the management services and data services. For details on the permissions required to call specific File service operations, see [Permissions for calling data operations](/rest/api/storageservices/authorize-with-azure-active-directory#permissions-for-calling-data-operations).
264
252
265
-
## Installation and example commands
266
-
267
253
If you haven't already done so, [install the latest version of Azure CLI](/cli/azure/install-azure-cli).
268
254
269
-
### Authorize access to file data
255
+
## Authorize access to file data
256
+
257
+
Follow these steps to authorize access to file data by using Azure CLI.
270
258
271
259
1. Sign in to your Azure account.
272
260
@@ -280,16 +268,16 @@ If you haven't already done so, [install the latest version of Azure CLI](/cli/a
280
268
az storage share create --name testshare1 --connection-string <connection-string>
281
269
```
282
270
283
-
1. Create a test directory and upload a file into the file share by using `az storage directory create` and `az storage file upload`. Specify the `--auth`mode as `login` and pass the `--backup-intent` parameter.
271
+
1. Create a test directory and upload a file into the file share by using `az storage directory create` and `az storage file upload`. Specify the `--auth-mode` as `login` and pass the `--backup-intent` parameter.
Because the CLI commands use authentication type as `login` (`--authmode``login`and`--backup-intent` parameter), the file and directory are created by using Entra credentials.
278
+
Because the CLI commands use authentication type as `login` (`--auth-modelogin`with the`--backup-intent` parameter), the file and directory are created by using Entra credentials.
291
279
292
-
For more information, refer to the latest CLI documentation for supported commands:
280
+
For more information, refer to the documentation for supported commands:
![prmerger-automator[bot]](https://avatars.githubusercontent.com/u/22479449?v=4&size=40){kind=avatar}
0 commit comments