Azure Storage built-in role

Storage File Data Privileged Contributor

Provides read, write, delete, and ACL-modification access to Azure file data by using privileged backup semantics that override existing file and directory NTFS permissions. Microsoft documents no equivalent built-in role on Windows file servers.

Control-plane actions (0)

None — this role grants no control-plane management actions.

Data-plane actions (6)

• Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read
• Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write
• Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete
• Microsoft.Storage/storageAccounts/fileServices/fileshares/files/modifypermissions/action
• Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action
• Microsoft.Storage/storageAccounts/fileServices/writeFileBackupSemantics/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

This is an Azure Files data-plane role with no management-plane Actions. Assign it at an individual file share or storage account; its privileged REST access applies to file data within that scope and can supersede file and directory ACLs, while management of the storage account and file share remains separate.

Common use cases (2)

• Run an approved backup, restore, migration, or auditing service that must read and modify all files and ACLs regardless of existing NTFS permissions.
• Grant the Azure File Sync managed identity privileged file access when the documented managed-identity deployment requires it.

Prerequisites (3)

• Use a client and REST API version that support Azure Files OAuth over REST and explicitly send the backup-intent header or tool option.
• Identify the managed identity or service principal and the narrowest file-share scope requiring ACL-bypassing access.
• Grant separate control-plane permissions if the workflow must navigate or manage the storage account or file share.

Best practices (3)

• Assign to a managed service identity rather than a human user and scope to an individual file share whenever possible.
• Use an ordinary SMB share role when the workload should remain subject to Windows ACLs.
• Review wildcard custom roles because Microsoft warns that higher-level storage wildcards can inherit new privileged file actions.

Security considerations (3)

• The role bypasses existing file and directory NTFS permissions and can read, write, delete, and change ACLs throughout its data scope.
• It provides storage-account-key-like data reach through Microsoft Entra authorization without granting storage-account management.
• A storage-account assignment reaches every file share in the account and should be treated as highly privileged data access.

Assignment guidance

Assign Storage File Data Privileged Contributor only to a trusted backup, restore, migration, or File Sync service identity, directly on the file share when supported. Require explicit backup intent, keep management roles separate, and use SMB Share Contributor or Elevated Contributor when ACL bypass is not required.

Related roles (3)

• Storage File Data Privileged Reader: ACL-bypassing read-only alternative for file data.
• Storage File Data SMB Share Elevated Contributor: Microsoft describes the privileged role as similar to the elevated SMB role but with the additional OAuth backup-semantics actions that override ACLs.
• Azure File Sync Administrator: Microsoft explicitly permits File Sync Administrator to assign this role to the File Sync service principal through its built-in condition.

Editorial sources (7)

• Azure built-in roles for Storage →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Assign share-level permissions for Azure Files →

  Supports: Description, Practical scope, Best practices, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Enable access to Azure file shares using OAuth over REST →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Deploy Azure File Sync →

  Supports: Common use cases, Assignment guidance, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →