Azure Storage built-in role

Storage File Data Privileged Reader

Reads Azure file data by using privileged backup semantics that override existing file and directory NTFS permissions. It cannot write, delete, or change ACLs, but Microsoft documents no equivalent built-in role on Windows file servers because of its ACL-bypassing read access.

Control-plane actions (0)

None — this role grants no control-plane management actions.

Data-plane actions (2)

• Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read
• Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

This is an Azure Files data-plane role with no management-plane Actions. Assign it at an individual file share or storage account; within that scope, privileged OAuth REST reads can supersede file and directory ACLs. Storage-account and file-share management permissions remain separate.

Common use cases (2)

• Run a backup, audit, discovery, or security service that must read every file regardless of NTFS permissions.
• Replace account-key-based read-all access with an identifiable Microsoft Entra service identity for supported Azure Files REST operations.

Prerequisites (3)

• Use a client and REST API version that support Azure Files OAuth over REST and explicitly send backup intent.
• Identify the managed identity or service principal and the narrowest share requiring ACL-bypassing reads.
• Grant separate management-plane read access if the client must navigate storage-account resources in the portal or management APIs.

Best practices (3)

• Assign to a managed service identity and directly on the file share whenever possible.
• Use Storage File Data SMB Share Reader when the user or application should remain subject to NTFS ACLs.
• Review and remove the assignment when the backup, audit, or migration operation ends.

Security considerations (3)

• The role can read all file data in scope regardless of file and directory NTFS permissions.
• It cannot modify data or ACLs, but ACL bypass can expose sensitive content that ordinary readers cannot access.
• A storage-account assignment reaches every file share in the account.

Assignment guidance

Assign Storage File Data Privileged Reader only to a trusted service identity that must perform ACL-bypassing reads, at the narrowest file-share scope. Require explicit backup intent and choose SMB Share Reader instead when normal ACL enforcement is required.

Related roles (2)

• Storage File Data Privileged Contributor: Adds ACL-bypassing write, delete, and ACL-modification operations.
• Storage File Data SMB Share Reader: Microsoft describes the privileged role as similar to the SMB reader but with the additional OAuth backup-semantics action that overrides ACLs.

Editorial sources (5)

• Azure built-in roles for Storage →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope. Retrieved 2026-07-16.

• Assign share-level permissions for Azure Files →

  Supports: Description, Practical scope, Best practices, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Enable access to Azure file shares using OAuth over REST →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →