Azure Storage built-in role
Storage File Data Privileged Contributor
Provides read, write, delete, and ACL-modification access to Azure file data by using privileged backup semantics that override existing file and directory NTFS permissions. Microsoft documents no equivalent built-in role on Windows file servers.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 69566ab7-960f-475b-8e7c-b3118f30c6bd
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (6)
Microsoft.Storage/storageAccounts/fileServices/fileshares/files/readMicrosoft.Storage/storageAccounts/fileServices/fileshares/files/writeMicrosoft.Storage/storageAccounts/fileServices/fileshares/files/deleteMicrosoft.Storage/storageAccounts/fileServices/fileshares/files/modifypermissions/actionMicrosoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/actionMicrosoft.Storage/storageAccounts/fileServices/writeFileBackupSemantics/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
This is an Azure Files data-plane role with no management-plane Actions. Assign it at an individual file share or storage account; its privileged REST access applies to file data within that scope and can supersede file and directory ACLs, while management of the storage account and file share remains separate.
Common use cases (2)
- Run an approved backup, restore, migration, or auditing service that must read and modify all files and ACLs regardless of existing NTFS permissions.
- Grant the Azure File Sync managed identity privileged file access when the documented managed-identity deployment requires it.
Prerequisites (3)
- Use a client and REST API version that support Azure Files OAuth over REST and explicitly send the backup-intent header or tool option.
- Identify the managed identity or service principal and the narrowest file-share scope requiring ACL-bypassing access.
- Grant separate control-plane permissions if the workflow must navigate or manage the storage account or file share.
Best practices (3)
- Assign to a managed service identity rather than a human user and scope to an individual file share whenever possible.
- Use an ordinary SMB share role when the workload should remain subject to Windows ACLs.
- Review wildcard custom roles because Microsoft warns that higher-level storage wildcards can inherit new privileged file actions.
Security considerations (3)
- The role bypasses existing file and directory NTFS permissions and can read, write, delete, and change ACLs throughout its data scope.
- It provides storage-account-key-like data reach through Microsoft Entra authorization without granting storage-account management.
- A storage-account assignment reaches every file share in the account and should be treated as highly privileged data access.
Assignment guidance
Assign Storage File Data Privileged Contributor only to a trusted backup, restore, migration, or File Sync service identity, directly on the file share when supported. Require explicit backup intent, keep management roles separate, and use SMB Share Contributor or Elevated Contributor when ACL bypass is not required.
Related roles (3)
- Storage File Data Privileged Reader: ACL-bypassing read-only alternative for file data.
- Storage File Data SMB Share Elevated Contributor: Microsoft describes the privileged role as similar to the elevated SMB role but with the additional OAuth backup-semantics actions that override ACLs.
- Azure File Sync Administrator: Microsoft explicitly permits File Sync Administrator to assign this role to the File Sync service principal through its built-in condition.
Common questions
When should I assign the Storage File Data Privileged Contributor Azure role?
Assign Storage File Data Privileged Contributor when you need to: Run an approved backup, restore, migration, or auditing service that must read and modify all files and ACLs regardless of existing NTFS permissions.; and Grant the Azure File Sync managed identity privileged file access when the documented managed-identity deployment requires it.. Practical scope: This is an Azure Files data-plane role with no management-plane Actions. Assign it at an individual file share or storage account; its privileged REST access applies to file data within that scope and can supersede file and directory ACLs, while management of the storage account and file share remains separate.
What permissions does the Storage File Data Privileged Contributor Azure role grant?
The role definition grants 6 combined control-plane and data-plane actions. Representative operations include: Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read; Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write; Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete; Microsoft.Storage/storageAccounts/fileServices/fileshares/files/modifypermissions/action; Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action; and Microsoft.Storage/storageAccounts/fileServices/writeFileBackupSemantics/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Storage File Data Privileged Contributor Azure role?
Key considerations when assigning Storage File Data Privileged Contributor: The role bypasses existing file and directory NTFS permissions and can read, write, delete, and change ACLs throughout its data scope.; It provides storage-account-key-like data reach through Microsoft Entra authorization without granting storage-account management.; and A storage-account assignment reaches every file share in the account and should be treated as highly privileged data access.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Storage →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-16.
- Assign share-level permissions for Azure Files →
Supports: Description, Practical scope, Best practices, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Enable access to Azure file shares using OAuth over REST →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Deploy Azure File Sync →
Supports: Common use cases, Assignment guidance, Related roles. Retrieved 2026-07-16.