Azure Storage built-in role

Azure File Sync Administrator

Provides full management of Azure File Sync Storage Sync Service resources. It can register servers, create sync groups and endpoints, and create constrained role assignments to service principals for Reader and Data Access, Storage File Data Privileged Contributor, or Storage Account Contributor; the role itself has no DataActions.

Control-plane actions (15)

• Microsoft.StorageSync/register/action
• Microsoft.StorageSync/unregister/action
• Microsoft.StorageSync/locations/*
• Microsoft.StorageSync/deployments/preflight/action
• Microsoft.StorageSync/storageSyncServices/*
• Microsoft.StorageSync/operations/read
• Microsoft.Authorization/roleAssignments/write
• Microsoft.Insights/AlertRules/*
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Storage/storageAccounts/read
• Microsoft.Storage/storageAccounts/fileServices/shares/read
• Microsoft.Storage/storageAccounts/fileServices/read
• Microsoft.Support/*
• Microsoft.Authorization/*/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Conditions (1)

• Condition version: 2.0

  ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR ((@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals {c12c1c16-33a1-487b-954d-41c89c60f349, 69566ab7-960f-475b-8e7c-b3118f30c6bd, 17d1049b-9a84-46fb-8f53-869881c3d3ab}) AND (@Request[Microsoft.Authorization/roleAssignments:PrincipalType] StringEqualsIgnoreCase 'ServicePrincipal')))

Assignable scopes (1)

• /

Practical scope

The role is assignable throughout the Azure hierarchy, but Microsoft documents assignment on the Storage Sync Service. Its roleAssignments/write action has an ABAC condition limiting the role definitions and principal type it can assign. Cloud-endpoint creation also requires approved storage-account permissions; read-only storage access is insufficient.

Common use cases (2)

• Administer Storage Sync Services, register Windows Servers, and create or update sync groups, cloud endpoints, and server endpoints.
• Deploy managed-identity-based Azure File Sync and create the specific service-principal role assignments allowed by the built-in condition.

Prerequisites (3)

• Prepare a supported Windows Server, an SMB Azure file share in the same region, and a Storage Sync Service.
• For the documented deployment path, allow storage account key access and grant the required storage-account role to the administrator or File Sync managed identity as applicable.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the Storage Sync Service scope.

Best practices (3)

• Assign on the Storage Sync Service rather than at subscription scope and retain the built-in role-assignment condition.
• Separate environments that require strict data isolation into different Storage Sync Services.
• Keep File Sync agents current and review who can write to the Storage Sync Service because writers can cause server data to flow into Azure storage they can access.

Security considerations (3)

• Full Storage Sync Service management can register servers and establish new synchronization relationships that move file data.
• The conditioned role-assignment permission can still grant service principals privileged file data or storage-account access; removing or weakening the condition expands escalation risk.
• Azure File Sync deployment currently depends on storage account key access for documented scenarios, so key-based access implications must be reviewed even though this role has no DataActions.

Assignment guidance

Assign Azure File Sync Administrator to the operators who register servers and manage sync topology, scoped to the intended Storage Sync Service. Preserve its ABAC condition, grant storage-account permissions separately only where the deployment requires them, and use Azure File Sync Reader for monitoring-only staff.

Related roles (4)

• Azure File Sync Reader: Read-only alternative for Storage Sync Service inspection.
• Reader and Data Access: One of the storage-account roles the File Sync deployment guide documents and the Administrator condition permits assigning to service principals.
• Storage File Data Privileged Contributor: One of the managed-identity storage roles explicitly allowed by the Administrator role condition.
• Storage Account Contributor: One of the storage-account roles explicitly allowed by the Administrator role condition.

Editorial sources (7)

• Azure built-in roles for Storage →

  Supports: Description, Practical scope, Security considerations, Related roles. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Deploy Azure File Sync →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Plan for an Azure File Sync deployment →

  Supports: Common use cases, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• Prevent authorization with Shared Key →

  Supports: Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →