Azure Storage built-in role
Storage File Delegator
Requests a File service user delegation key that can sign a user delegation SAS for a file or Azure file share. The key cannot access file data directly and the role has no DataActions; separate file data permissions bound what the resulting SAS can authorize.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 765a04e0-5de8-4bb2-9bf6-b2a30bc03e91
Control-plane actions (1)
Microsoft.Storage/storageAccounts/fileServices/generateUserDelegationKey/action
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
The delegation-key operation acts at storage-account level, so assign this role on the storage account, resource group, or subscription. Keep any separate file data role scoped to the intended share so key generation does not automatically widen direct data access.
Common use cases (2)
- Let a trusted SAS broker issue short-lived user delegation SAS tokens for approved Azure Files clients.
- Give an identity account-level key-generation authority while keeping its direct file data access constrained to one share.
Prerequisites (3)
- Use a supported user delegation SAS service version and grant the broker a separate file data permission that defines what it may delegate.
- Design the SAS resource, permissions, expiry, HTTPS requirement, distribution, logging, and revocation process.
- The assigning administrator needs Microsoft.Authorization/roleAssignments/write at storage-account scope or higher.
Best practices (3)
- Assign to a dedicated SAS-broker managed identity, not broadly to file-share users.
- Issue the narrowest permissions and shortest practical expiry, require HTTPS, and log every issuance in the broker.
- Maintain a tested revocation process and remove the role when SAS issuance is no longer required.
Security considerations (3)
- A delegation key can sign multiple bearer SAS tokens during its lifetime, and a leaked SAS can be used until expiry or revocation.
- The role alone does not read file data, but its combination with broad file permissions determines the maximum delegated access.
- SAS generation is not tracked by Azure Storage, so the broker must provide its own issuance audit trail.
Assignment guidance
Assign Storage File Delegator to a trusted SAS-broker identity on one storage account, with a separate file data role constrained to the intended share. Generate short-lived HTTPS-only SAS tokens, record issuance, and test revocation before production use.
Related roles (2)
- Storage File Data SMB Share Reader: A separate data role that can bound delegated file access to reads.
- Storage File Data SMB Share Contributor: A separate data role that can bound delegated file access to read, write, and delete.
Common questions
When should I assign the Storage File Delegator Azure role?
Assign Storage File Delegator when you need to: Let a trusted SAS broker issue short-lived user delegation SAS tokens for approved Azure Files clients.; and Give an identity account-level key-generation authority while keeping its direct file data access constrained to one share.. Practical scope: The delegation-key operation acts at storage-account level, so assign this role on the storage account, resource group, or subscription. Keep any separate file data role scoped to the intended share so key generation does not automatically widen direct data access.
What permissions does the Storage File Delegator Azure role grant?
The role definition grants 1 combined control-plane and data-plane actions. Representative operations include: Microsoft.Storage/storageAccounts/fileServices/generateUserDelegationKey/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Storage File Delegator Azure role?
Key considerations when assigning Storage File Delegator: A delegation key can sign multiple bearer SAS tokens during its lifetime, and a leaked SAS can be used until expiry or revocation.; The role alone does not read file data, but its combination with broad file permissions determines the maximum delegated access.; and SAS generation is not tracked by Azure Storage, so the broker must provide its own issuance audit trail.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for Storage →
Supports: Description. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope. Retrieved 2026-07-16.
- Grant limited access to data with shared access signatures →
Supports: Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.
- Create a user delegation SAS →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.