Azure Storage built-in role
Storage File Data Privileged Reader
Reads Azure file data by using privileged backup semantics that override existing file and directory NTFS permissions. It cannot write, delete, or change ACLs, but Microsoft documents no equivalent built-in role on Windows file servers because of its ACL-bypassing read access.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: b8eda974-7b85-4f76-af95-65846b26df6d
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (2)
Microsoft.Storage/storageAccounts/fileServices/fileshares/files/readMicrosoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
This is an Azure Files data-plane role with no management-plane Actions. Assign it at an individual file share or storage account; within that scope, privileged OAuth REST reads can supersede file and directory ACLs. Storage-account and file-share management permissions remain separate.
Common use cases (2)
- Run a backup, audit, discovery, or security service that must read every file regardless of NTFS permissions.
- Replace account-key-based read-all access with an identifiable Microsoft Entra service identity for supported Azure Files REST operations.
Prerequisites (3)
- Use a client and REST API version that support Azure Files OAuth over REST and explicitly send backup intent.
- Identify the managed identity or service principal and the narrowest share requiring ACL-bypassing reads.
- Grant separate management-plane read access if the client must navigate storage-account resources in the portal or management APIs.
Best practices (3)
- Assign to a managed service identity and directly on the file share whenever possible.
- Use Storage File Data SMB Share Reader when the user or application should remain subject to NTFS ACLs.
- Review and remove the assignment when the backup, audit, or migration operation ends.
Security considerations (3)
- The role can read all file data in scope regardless of file and directory NTFS permissions.
- It cannot modify data or ACLs, but ACL bypass can expose sensitive content that ordinary readers cannot access.
- A storage-account assignment reaches every file share in the account.
Assignment guidance
Assign Storage File Data Privileged Reader only to a trusted service identity that must perform ACL-bypassing reads, at the narrowest file-share scope. Require explicit backup intent and choose SMB Share Reader instead when normal ACL enforcement is required.
Related roles (2)
- Storage File Data Privileged Contributor: Adds ACL-bypassing write, delete, and ACL-modification operations.
- Storage File Data SMB Share Reader: Microsoft describes the privileged role as similar to the SMB reader but with the additional OAuth backup-semantics action that overrides ACLs.
Common questions
When should I assign the Storage File Data Privileged Reader Azure role?
Assign Storage File Data Privileged Reader when you need to: Run a backup, audit, discovery, or security service that must read every file regardless of NTFS permissions.; and Replace account-key-based read-all access with an identifiable Microsoft Entra service identity for supported Azure Files REST operations.. Practical scope: This is an Azure Files data-plane role with no management-plane Actions. Assign it at an individual file share or storage account; within that scope, privileged OAuth REST reads can supersede file and directory ACLs. Storage-account and file-share management permissions remain separate.
What permissions does the Storage File Data Privileged Reader Azure role grant?
The role definition grants 2 combined control-plane and data-plane actions. Representative operations include: Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read; and Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Storage File Data Privileged Reader Azure role?
Key considerations when assigning Storage File Data Privileged Reader: The role can read all file data in scope regardless of file and directory NTFS permissions.; It cannot modify data or ACLs, but ACL bypass can expose sensitive content that ordinary readers cannot access.; and A storage-account assignment reaches every file share in the account.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for Storage →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope. Retrieved 2026-07-16.
- Assign share-level permissions for Azure Files →
Supports: Description, Practical scope, Best practices, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Enable access to Azure file shares using OAuth over REST →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.