Azure Storage built-in role

Storage File Data SMB Admin

Provides end users with administrative SMB access equivalent to using the storage account key. Its data permissions include reading, writing, deleting, changing permissions, using read and write backup semantics, and taking ownership of Azure Files data.

Control-plane actions (0)

None — this role grants no control-plane management actions.

Data-plane actions (7)

• Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read
• Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write
• Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete
• Microsoft.Storage/storageAccounts/fileServices/fileshares/files/modifypermissions/action
• Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action
• Microsoft.Storage/storageAccounts/fileServices/writeFileBackupSemantics/action
• Microsoft.Storage/storageAccounts/fileServices/takeOwnership/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

This is a data-plane role with no management-plane Actions. It can be assigned at a file-share or storage-account scope, but its administrative permissions can bypass ordinary ACL barriers and act across all file data in the effective scope. Storage-account configuration remains a separate control-plane concern.

Common use cases (2)

• Give a tightly controlled file administrator the SMB authority needed to repair ownership or permissions across an Azure file share.
• Replace direct storage-account-key use for a supported end-user administrative SMB workflow with an attributable Microsoft Entra identity.

Prerequisites (3)

• Enable and configure a supported identity source for Azure Files SMB authentication.
• Confirm that ordinary Elevated Contributor or Take Ownership access cannot complete the administration task.
• Assign the role to the authorized Microsoft Entra user or group at the narrowest file-share scope.

Best practices (3)

• Reserve this role for file administrators and use a time-bound assignment for exceptional recovery or ACL repair.
• Assign on one file share rather than the storage account whenever possible.
• Use ordinary SMB Reader, Contributor, or Elevated Contributor roles for routine access that should follow Windows ACLs.

Security considerations (3)

• The role combines full file mutation, ACL modification, backup semantics, and take-ownership authority and is explicitly equivalent to account-key admin access over SMB.
• It can overcome ownership and permission barriers that protect data from ordinary share users.
• A storage-account assignment provides administrative SMB reach across all shares in the account.

Assignment guidance

Assign Storage File Data SMB Admin only to designated file administrators for a documented administrative task, preferably on one file share and for a limited time. Use Take Ownership for ownership-only recovery or Elevated Contributor for routine ACL changes that do not require full admin equivalence.

Related roles (2)

• Storage File Data SMB Take Ownership: Narrower role for assuming ownership without the full admin data operation set.
• Storage File Data SMB Share Elevated Contributor: Routine read, write, delete, and ACL-modification role without admin backup semantics or take ownership.

Editorial sources (5)

• Azure built-in roles for Storage →

  Supports: Description, Practical scope, Common use cases, Security considerations, Related roles. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Assign share-level permissions for Azure Files →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Microsoft Entra Kerberos authentication for Azure Files →

  Supports: Prerequisites. Retrieved 2026-07-16.

Official Microsoft Learn documentation →