Azure Storage built-in role

Storage File Data SMB Share Contributor

Provides read, write, and delete access to files and directories in Azure file shares over SMB. It grants the share-level Azure RBAC permission, while Windows ACLs on individual directories and files continue to determine the effective fine-grained access.

Control-plane actions (0)

None — this role grants no control-plane management actions.

Data-plane actions (3)

• Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read
• Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write
• Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

This is a data-plane role with no management-plane Actions. Assign it to a specific Microsoft Entra user, group, or service principal at the file-share scope when possible. A storage-account assignment covers every share; after share-level authorization, Windows ACLs are enforced on directories and files.

Common use cases (2)

• Grant a team or application ordinary read, create, update, and delete access to an SMB Azure file share.
• Provide share-level access while retaining Windows ACLs for folder- and file-level authorization.

Prerequisites (3)

• Enable one supported identity source for SMB authentication on the storage account.
• For specific hybrid identities, synchronize the required users or groups to Microsoft Entra ID as documented for the selected identity source.
• Configure Windows ACLs in addition to the share-level role assignment.

Best practices (3)

• Assign to groups rather than individual users and scope directly to the file share.
• Use SMB Share Reader for read-only access and Elevated Contributor only when the principal must modify ACLs.
• Keep default share-level permissions at None unless broad access for all authenticated identities is a deliberate requirement.

Security considerations (3)

• The role permits file creation, modification, and deletion within the effective share and ACL boundary.
• The higher permission wins when a principal receives both a default share permission and a specific role assignment.
• A storage-account assignment extends the role to all file shares and can expose more data than intended.

Assignment guidance

Assign Storage File Data SMB Share Contributor to a synchronized group or workload identity on the individual file share, then configure Windows ACLs for the needed directories and files. Use Reader for read-only access or Elevated Contributor only for approved ACL changes.

Related roles (2)

• Storage File Data SMB Share Reader: Read-only share-level alternative.
• Storage File Data SMB Share Elevated Contributor: Adds permission to modify Windows ACLs.

Editorial sources (6)

• Azure built-in roles for Storage →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Assign share-level permissions for Azure Files →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Microsoft Entra Kerberos authentication for Azure Files →

  Supports: Prerequisites. Retrieved 2026-07-16.

Official Microsoft Learn documentation →