Azure Storage built-in role
Storage File Data SMB Share Reader
Provides read access to files and directories in Azure file shares over SMB. Microsoft describes it as similar to a file-share ACL of read on a Windows file server; share-level Azure RBAC grants entry to the share and Windows ACLs continue to enforce directory- and file-level access.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: aba4ae5f-2193-4029-9191-0cb91df5e314
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (1)
Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
This is a data-plane role with no management-plane Actions. Assign it on an individual file share when possible. A storage-account assignment covers all shares, while the effective read access within each share remains subject to Windows ACLs.
Common use cases (2)
- Give a user group or application read-only access to an SMB Azure file share.
- Provide share-level authorization while preserving existing Windows ACL restrictions on folders and files.
Prerequisites (3)
- Enable a supported identity source for SMB authentication on the storage account.
- Synchronize or otherwise configure the user or group identity as required by the chosen identity source.
- Configure Windows ACLs that permit the intended directory and file reads.
Best practices (3)
- Assign to a group and directly on the target file share.
- Use this role instead of Contributor when the principal must not create, change, or delete files.
- Avoid a permissive default share-level role when only selected identities require access.
Security considerations (3)
- The role exposes file contents permitted by the share assignment and Windows ACLs.
- It cannot write, delete, change ACLs, bypass ACLs, or take ownership.
- A higher default share permission or another role assignment can raise the principal's effective permission above read-only.
Assignment guidance
Assign Storage File Data SMB Share Reader to the approved group on the individual file share, then verify the Windows ACLs expose only the required folders and files. Check default share permissions and other assignments so they do not silently grant a higher level.
Related roles (2)
- Storage File Data SMB Share Contributor: Adds file write and delete operations.
- Storage File Data Privileged Reader: Read role that uses backup semantics to override existing ACLs.
Common questions
When should I assign the Storage File Data SMB Share Reader Azure role?
Assign Storage File Data SMB Share Reader when you need to: Give a user group or application read-only access to an SMB Azure file share.; and Provide share-level authorization while preserving existing Windows ACL restrictions on folders and files.. Practical scope: This is a data-plane role with no management-plane Actions. Assign it on an individual file share when possible. A storage-account assignment covers all shares, while the effective read access within each share remains subject to Windows ACLs.
What permissions does the Storage File Data SMB Share Reader Azure role grant?
The role definition grants 1 combined control-plane and data-plane actions. Representative operations include: Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Storage File Data SMB Share Reader Azure role?
Key considerations when assigning Storage File Data SMB Share Reader: The role exposes file contents permitted by the share assignment and Windows ACLs.; It cannot write, delete, change ACLs, bypass ACLs, or take ownership.; and A higher default share permission or another role assignment can raise the principal's effective permission above read-only.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Storage →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Assign share-level permissions for Azure Files →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Enable access to Azure file shares using OAuth over REST →
Supports: Related roles. Retrieved 2026-07-16.
- Microsoft Entra Kerberos authentication for Azure Files →
Supports: Prerequisites. Retrieved 2026-07-16.