You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-netapp-files/network-attached-storage-permissions.md
+10-10Lines changed: 10 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,13 +5,13 @@ services: azure-netapp-files
5
5
author: b-ahibbard
6
6
ms.service: azure-netapp-files
7
7
ms.topic: concept-article
8
-
ms.date: 11/13/2023
8
+
ms.date: 01/13/2025
9
9
ms.author: anfdocs
10
10
---
11
11
12
12
# Understand NAS share permissions in Azure NetApp Files
13
13
14
-
Azure NetApp Files provides several ways to secure your NAS data. One aspect of that security is permissions. In NAS, permissions can be broken down into two categories:
14
+
Azure NetApp Files provides several ways to secure your network attached storage (NAS) data. One aspect of that security is permissions. In NAS, permissions can be broken down into two categories:
15
15
16
16
***Share access permissions** limit who can mount a NAS volume. NFS controls share access permissions via IP address or hostname. SMB controls this via user and group access control lists (ACLs).
17
17
***[File access permissions](network-attached-file-permissions.md)** limit what users and groups can do once a NAS volume is mounted. File access permissions are applied to individual files and folders.
@@ -49,7 +49,7 @@ When creating an Azure NetApp Files volume, there are several options configurab
49
49
50
50
### Default policy rule in Azure NetApp Files
51
51
52
-
When creating a new volume, a default policy rule is created. The default policy prevents a scenario where a volume is created without policy rules, which would restrict access for any client attempting access to the export. If there are no rules, there is no access.
52
+
When creating a new volume, a default policy rule is created. The default policy prevents a scenario where a volume is created without policy rules, which would restrict access for any client attempting access to the export. Without rules, there's no access to the volume.
53
53
54
54
The default rule has the following values:
55
55
@@ -85,7 +85,7 @@ To learn more about managing export policies, see [Configure export policies for
85
85
86
86
#### Export policy rule ordering
87
87
88
-
The order of export policy rules determines how they are applied. The first rule in the list that applies to an NFS client is the rule used for that client. When using CIDR ranges/subnets for export policy rules, an NFS client in that range may receive unwanted access due to the range in which it's included.
88
+
The order of export policy rules determines how they're applied. The first rule in the list that applies to an NFS client is the rule used for that client. When using CIDR ranges/subnets for export policy rules, an NFS client in that range might receive unwanted access due to the range in which it's included.
89
89
90
90
Consider the following example:
91
91
@@ -103,7 +103,7 @@ To fix this and set access to the desired level, the rules can be re-ordered to
103
103
104
104
## SMB shares
105
105
106
-
SMB shares enable end users can access SMB or dual-protocol volumes in Azure NetApp Files. Access controls for SMB shares are limited in the Azure NetApp Files control plane to only SMB security options such as access-based enumeration and non-browsable share functionality. These security options are configured during volume creation with the **Edit volume** functionality.
106
+
SMB shares enable end users can access SMB or dual-protocol volumes in Azure NetApp Files. Access controls for SMB shares are limited in the Azure NetApp Files control plane to only SMB security options such as access-based enumeration and nonbrowsable share functionality. These security options are configured during volume creation with the **Edit volume** functionality.
107
107
108
108
:::image type="content" source="./media/network-attached-storage-permissions/share-level-permissions.png" alt-text="Screenshot of share-level permissions." lightbox="./media/network-attached-storage-permissions/share-level-permissions.png":::
109
109
@@ -137,19 +137,19 @@ With access-based enumeration enabled, `ABE-file` doesn't display to the user.
137
137
138
138
#### Non-browsable shares
139
139
140
-
The non-browsable shares feature in Azure NetApp Files limits clients from browsing for an SMB share by hiding the share from view in Windows Explorer or when listing shares in "net view." Only end users that know the absolute paths to the share are able to find the share.
140
+
The nonbrowsable shares feature in Azure NetApp Files limits clients from browsing for an SMB share by hiding the share from view in Windows Explorer or when listing shares in "net view." Only end users that know the absolute paths to the share are able to find the share.
141
141
142
-
In the following image, the non-browsable share property isn't enabled for `SMBVolume`, so the volume displays in the listing of the file server (using `\\servername`).
142
+
In the following image, the nonbrowsable share property isn't enabled for `SMBVolume`, so the volume displays in the listing of the file server (using `\\servername`).
143
143
144
144
:::image type="content" source="./media/network-attached-storage-permissions/directory-with-smb-volume.png" alt-text="Screenshot of a directory that includes folder SMBVolume." lightbox="./media/network-attached-storage-permissions/directory-with-smb-volume.png":::
145
145
146
-
With non-browsable shares enabled on `SMBVolume` in Azure NetApp Files, the same view of the file server excludes `SMBVolume`.
146
+
With nonbrowsable shares enabled on `SMBVolume` in Azure NetApp Files, the same view of the file server excludes `SMBVolume`.
147
147
148
-
In the next image, the share `SMBVolume` has non-browsable shares enabled in Azure NetApp Files. When that is enabled, this is the view of the top level of the file server.
148
+
In the next image, the share `SMBVolume` has nonbrowsable shares enabled in Azure NetApp Files. When that is enabled, this is the view of the top level of the file server.
149
149
150
150
:::image type="content" source="./media/network-attached-storage-permissions/directory-no-smb-volume.png" alt-text="Screenshot of a directory with two sub-directories." lightbox="./media/network-attached-storage-permissions/directory-no-smb-volume.png":::
151
151
152
-
Even though the volume in the listing cannot be seen, it remains accessible if the user knows the file path.
152
+
Even though the volume in the listing can't be seen, it remains accessible if the user knows the file path.
153
153
154
154
:::image type="content" source="./media/network-attached-storage-permissions/smb-volume-file-path.png" alt-text="Screenshot of Windows Explorer with file path highlighted." lightbox="./media/network-attached-storage-permissions/smb-volume-file-path.png":::
![prmerger-automator[bot]](https://avatars.githubusercontent.com/u/22479449?v=4&size=40){kind=avatar}
0 commit comments