Azure Storage built-in role

Storage File Delegator

Requests a File service user delegation key that can sign a user delegation SAS for a file or Azure file share. The key cannot access file data directly and the role has no DataActions; separate file data permissions bound what the resulting SAS can authorize.

Control-plane actions (1)

• Microsoft.Storage/storageAccounts/fileServices/generateUserDelegationKey/action

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The delegation-key operation acts at storage-account level, so assign this role on the storage account, resource group, or subscription. Keep any separate file data role scoped to the intended share so key generation does not automatically widen direct data access.

Common use cases (2)

• Let a trusted SAS broker issue short-lived user delegation SAS tokens for approved Azure Files clients.
• Give an identity account-level key-generation authority while keeping its direct file data access constrained to one share.

Prerequisites (3)

• Use a supported user delegation SAS service version and grant the broker a separate file data permission that defines what it may delegate.
• Design the SAS resource, permissions, expiry, HTTPS requirement, distribution, logging, and revocation process.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at storage-account scope or higher.

Best practices (3)

• Assign to a dedicated SAS-broker managed identity, not broadly to file-share users.
• Issue the narrowest permissions and shortest practical expiry, require HTTPS, and log every issuance in the broker.
• Maintain a tested revocation process and remove the role when SAS issuance is no longer required.

Security considerations (3)

• A delegation key can sign multiple bearer SAS tokens during its lifetime, and a leaked SAS can be used until expiry or revocation.
• The role alone does not read file data, but its combination with broad file permissions determines the maximum delegated access.
• SAS generation is not tracked by Azure Storage, so the broker must provide its own issuance audit trail.

Assignment guidance

Assign Storage File Delegator to a trusted SAS-broker identity on one storage account, with a separate file data role constrained to the intended share. Generate short-lived HTTPS-only SAS tokens, record issuance, and test revocation before production use.

Related roles (2)

• Storage File Data SMB Share Reader: A separate data role that can bound delegated file access to reads.
• Storage File Data SMB Share Contributor: A separate data role that can bound delegated file access to read, write, and delete.

Editorial sources (5)

• Azure built-in roles for Storage →

  Supports: Description. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope. Retrieved 2026-07-16.

• Grant limited access to data with shared access signatures →

  Supports: Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• Create a user delegation SAS →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →