Azure Storage built-in role

Storage File Data SMB Share Elevated Contributor

Provides read, write, delete, and NTFS ACL-modification access to files and directories in Azure file shares over SMB. Microsoft describes it as similar to a file-share ACL of change on a Windows file server; it does not include the backup-semantics ACL bypass or take-ownership permissions of the privileged admin roles.

Control-plane actions (0)

None — this role grants no control-plane management actions.

Data-plane actions (4)

• Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read
• Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write
• Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete
• Microsoft.Storage/storageAccounts/fileServices/fileshares/files/modifypermissions/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

This is a data-plane role with no management-plane Actions. Assign it at an individual file share when possible. Share-level Azure RBAC authorizes access, and Windows ACLs remain part of effective access, but this role can modify those ACLs within the accessible scope.

Common use cases (2)

• Delegate routine file-share administration that requires changing directory and file ACLs as well as reading, writing, and deleting data.
• Let a migration or operations team preserve or adjust permissions without granting storage-account-key-equivalent SMB administration.

Prerequisites (3)

• Enable a supported Azure Files SMB identity source and configure the target identity.
• Confirm that ACL modification is required; otherwise use SMB Share Contributor.
• Define the initial Windows ACLs and assign the role at the narrowest file-share scope.

Best practices (3)

• Assign to a designated file-share administrator group rather than ordinary users.
• Scope to one share and review ACL changes through the organization's file-permission governance process.
• Use SMB Admin, Take Ownership, or privileged REST roles only for exceptional operations that this role cannot perform.

Security considerations (3)

• The assignee can change ACLs and thereby alter other users' effective access to file data.
• The role can also read, write, and delete files within its effective RBAC and ACL boundary.
• It does not include backup-semantics ACL bypass or take ownership, which are separate higher-risk capabilities.

Assignment guidance

Assign Storage File Data SMB Share Elevated Contributor to the file-share administrator group on one share only when ACL changes are part of the job. Use ordinary Contributor for data mutation without ACL management and reserve admin or privileged roles for documented recovery workflows.

Related roles (3)

• Storage File Data SMB Share Contributor: Read, write, and delete alternative without ACL modification.
• Storage File Data Privileged Contributor: Similar mutation and ACL operations over OAuth REST, with additional backup semantics that override existing ACLs.
• Storage File Data SMB Admin: Adds account-key-equivalent SMB administration and take ownership.

Editorial sources (5)

• Azure built-in roles for Storage →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Assign share-level permissions for Azure Files →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Enable access to Azure file shares using OAuth over REST →

  Supports: Description, Security considerations, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →