Azure Storage built-in role
Storage File Data SMB Share Contributor
Provides read, write, and delete access to files and directories in Azure file shares over SMB. It grants the share-level Azure RBAC permission, while Windows ACLs on individual directories and files continue to determine the effective fine-grained access.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (3)
Microsoft.Storage/storageAccounts/fileServices/fileshares/files/readMicrosoft.Storage/storageAccounts/fileServices/fileshares/files/writeMicrosoft.Storage/storageAccounts/fileServices/fileshares/files/delete
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
This is a data-plane role with no management-plane Actions. Assign it to a specific Microsoft Entra user, group, or service principal at the file-share scope when possible. A storage-account assignment covers every share; after share-level authorization, Windows ACLs are enforced on directories and files.
Common use cases (2)
- Grant a team or application ordinary read, create, update, and delete access to an SMB Azure file share.
- Provide share-level access while retaining Windows ACLs for folder- and file-level authorization.
Prerequisites (3)
- Enable one supported identity source for SMB authentication on the storage account.
- For specific hybrid identities, synchronize the required users or groups to Microsoft Entra ID as documented for the selected identity source.
- Configure Windows ACLs in addition to the share-level role assignment.
Best practices (3)
- Assign to groups rather than individual users and scope directly to the file share.
- Use SMB Share Reader for read-only access and Elevated Contributor only when the principal must modify ACLs.
- Keep default share-level permissions at None unless broad access for all authenticated identities is a deliberate requirement.
Security considerations (3)
- The role permits file creation, modification, and deletion within the effective share and ACL boundary.
- The higher permission wins when a principal receives both a default share permission and a specific role assignment.
- A storage-account assignment extends the role to all file shares and can expose more data than intended.
Assignment guidance
Assign Storage File Data SMB Share Contributor to a synchronized group or workload identity on the individual file share, then configure Windows ACLs for the needed directories and files. Use Reader for read-only access or Elevated Contributor only for approved ACL changes.
Related roles (2)
- Storage File Data SMB Share Reader: Read-only share-level alternative.
- Storage File Data SMB Share Elevated Contributor: Adds permission to modify Windows ACLs.
Common questions
When should I assign the Storage File Data SMB Share Contributor Azure role?
Assign Storage File Data SMB Share Contributor when you need to: Grant a team or application ordinary read, create, update, and delete access to an SMB Azure file share.; and Provide share-level access while retaining Windows ACLs for folder- and file-level authorization.. Practical scope: This is a data-plane role with no management-plane Actions. Assign it to a specific Microsoft Entra user, group, or service principal at the file-share scope when possible. A storage-account assignment covers every share; after share-level authorization, Windows ACLs are enforced on directories and files.
What permissions does the Storage File Data SMB Share Contributor Azure role grant?
The role definition grants 3 combined control-plane and data-plane actions. Representative operations include: Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read; Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write; and Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Storage File Data SMB Share Contributor Azure role?
Key considerations when assigning Storage File Data SMB Share Contributor: The role permits file creation, modification, and deletion within the effective share and ACL boundary.; The higher permission wins when a principal receives both a default share permission and a specific role assignment.; and A storage-account assignment extends the role to all file shares and can expose more data than intended.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Storage →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-16.
- Assign share-level permissions for Azure Files →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Microsoft Entra Kerberos authentication for Azure Files →
Supports: Prerequisites. Retrieved 2026-07-16.