Skip to content

Commit c8f0a92

Browse files
Merge pull request #288745 from khdownie/kendownie101824
Redo auth flow
2 parents 2097e70 + 800108a commit c8f0a92

7 files changed

+131
-322
lines changed

articles/storage/files/TOC.yml

Lines changed: 44 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,50 @@
7777
href: ../common/storage-use-azcopy-files.md?toc=/azure/storage/files/toc.json
7878
- name: Configure, optimize, and troubleshoot AzCopy
7979
href: ../common/storage-use-azcopy-configure.md?toc=/azure/storage/files/toc.json
80+
- name: Authentication and authorization
81+
items:
82+
- name: Overview of identity-based authentication options
83+
href: storage-files-active-directory-overview.md
84+
- name: Windows identity-based authentication
85+
items:
86+
- name: Enable an AD source
87+
items:
88+
- name: On-premises AD DS authentication
89+
items:
90+
- name: AD DS overview
91+
href: storage-files-identity-auth-active-directory-enable.md
92+
- name: Enable AD DS authentication
93+
href: storage-files-identity-ad-ds-enable.md
94+
- name: Use Azure Files with multiple AD DS forests
95+
href: storage-files-identity-multiple-forests.md
96+
- name: Update password
97+
href: storage-files-identity-ad-ds-update-password.md
98+
- name: Microsoft Entra Domain Services authentication
99+
items:
100+
- name: Enable Microsoft Entra Domain Services
101+
href: storage-files-identity-auth-domain-services-enable.md
102+
- name: Microsoft Entra Kerberos authentication
103+
items:
104+
- name: Enable authentication for hybrid identities
105+
href: storage-files-identity-auth-hybrid-identities-enable.md
106+
- name: Enable authentication for hybrid identities on legacy clients
107+
href: storage-files-identity-auth-hybrid-cloud-trust.md
108+
- name: Assign and manage permissions
109+
items:
110+
- name: Assign share-level permissions
111+
href: storage-files-identity-ad-ds-assign-permissions.md
112+
- name: Assign directory/file-level permissions
113+
href: storage-files-identity-ad-ds-configure-permissions.md
114+
- name: Mount file share
115+
href: storage-files-identity-ad-ds-mount-file-share.md
116+
- name: Linux identity-based authentication
117+
href: storage-files-identity-auth-linux-kerberos-enable.md
118+
- name: Authorize access to file data
119+
items:
120+
- name: Choose how to authorize access to file data
121+
href: authorize-data-operations-portal.md
122+
- name: Authorize access with Microsoft Entra ID using OAuth over REST
123+
href: authorize-oauth-rest.md
80124
- name: Security and networking
81125
items:
82126
- name: Networking
@@ -137,40 +181,6 @@
137181
href: ../common/transport-layer-security-configure-minimum-version.md?toc=/azure/storage/files/toc.json
138182
- name: Configure TLS version for a client application
139183
href: ../common/transport-layer-security-configure-client-version.md?toc=/azure/storage/files/toc.json
140-
- name: Authorization
141-
items:
142-
- name: Overview of identity-based authentication options
143-
href: storage-files-active-directory-overview.md
144-
- name: Enable on-premises AD DS authentication
145-
items:
146-
- name: AD DS overview
147-
href: storage-files-identity-auth-active-directory-enable.md
148-
- name: Enable AD DS authentication
149-
href: storage-files-identity-ad-ds-enable.md
150-
- name: Assign share-level permissions
151-
href: storage-files-identity-ad-ds-assign-permissions.md
152-
- name: Assign directory/file-level permissions
153-
href: storage-files-identity-ad-ds-configure-permissions.md
154-
- name: Mount file share
155-
href: storage-files-identity-ad-ds-mount-file-share.md
156-
- name: Update password
157-
href: storage-files-identity-ad-ds-update-password.md
158-
- name: Use Azure Files with multiple AD DS forests
159-
href: storage-files-identity-multiple-forests.md
160-
- name: Enable Microsoft Entra Domain Services authentication
161-
href: storage-files-identity-auth-domain-services-enable.md
162-
- name: Enable Microsoft Entra Kerberos authentication
163-
items:
164-
- name: Enable authentication for hybrid identities
165-
href: storage-files-identity-auth-hybrid-identities-enable.md
166-
- name: Enable authentication for hybrid identities on legacy clients
167-
href: storage-files-identity-auth-hybrid-cloud-trust.md
168-
- name: Enable AD Kerberos authentication for Linux clients (SMB)
169-
href: storage-files-identity-auth-linux-kerberos-enable.md
170-
- name: Choose how to authorize access to file data
171-
href: authorize-data-operations-portal.md
172-
- name: Authorize access with Microsoft Entra ID using OAuth over REST
173-
href: authorize-oauth-rest.md
174184
- name: Enable threat protection
175185
href: ../common/azure-defender-storage-configure.md?toc=/azure/storage/files/toc.json
176186
- name: Configure root squash (NFS shares)

articles/storage/files/storage-files-identity-ad-ds-assign-permissions.md

Lines changed: 19 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
---
22
title: Assign share-level permissions for Azure Files
3-
description: Learn how to control access to Azure Files by assigning share-level permissions to a Microsoft Entra identity that represents a hybrid user to control user access to Azure file shares with identity-based authentication.
3+
description: Learn how to control access to Azure Files by assigning share-level permissions to control user access to Azure file shares with identity-based authentication.
44
author: khdownie
55
ms.service: azure-file-storage
66
ms.topic: how-to
7-
ms.date: 05/09/2024
7+
ms.date: 10/18/2024
88
ms.author: kendownie
99
ms.custom: devx-track-azurepowershell, subject-rbac-steps, devx-track-azurecli, engagement-fy23
1010
ms.devlang: azurecli
@@ -28,30 +28,32 @@ Once you've enabled an Active Directory (AD) source for your storage account, yo
2828

2929
## Choose how to assign share-level permissions
3030

31-
Share-level permissions on Azure file shares are configured for Microsoft Entra users, groups, or service principals, while directory and file-level permissions are enforced using Windows access control lists (ACLs). You must assign share-level permissions to the Microsoft Entra identity representing the same user, group, or service principal in your AD DS in order to support AD DS authentication to your Azure file share. Authentication and authorization against identities that only exist in Microsoft Entra ID, such as Azure Managed Identities (MSIs), aren't supported.
31+
Share-level permissions on Azure file shares are configured for Microsoft Entra users, groups, or service principals, while directory and file-level permissions are enforced using Windows access control lists (ACLs). You must assign share-level permissions to the Microsoft Entra identity representing the user, group, or service principal that should have access. Authentication and authorization against identities that only exist in Microsoft Entra ID, such as Azure Managed Identities (MSIs), aren't supported.
3232

3333
Most users should assign share-level permissions to specific Microsoft Entra users or groups, and then use Windows ACLs for granular access control at the directory and file level. This is the most stringent and secure configuration.
3434

35-
There are three scenarios where we instead recommend using a [default share-level permission](#share-level-permissions-for-all-authenticated-identities) to allow contributor, elevated contributor, or reader access to all authenticated identities:
35+
There are three scenarios where we instead recommend using a [default share-level permission](#share-level-permissions-for-all-authenticated-identities) to allow reader, contributor, elevated contributor, privileged contributor, or privileged reader access to all authenticated identities:
3636

3737
- If you're unable to sync your on-premises AD DS to Microsoft Entra ID, you can use a default share-level permission. Assigning a default share-level permission allows you to work around the sync requirement because you don't need to specify the permission to identities in Microsoft Entra ID. Then you can use Windows ACLs for granular permission enforcement on your files and directories.
3838
- Identities that are tied to an AD but aren't synching to Microsoft Entra ID can also leverage the default share-level permission. This could include standalone Managed Service Accounts (sMSA), group Managed Service Accounts (gMSA), and computer accounts.
3939
- The on-premises AD DS you're using is synched to a different Microsoft Entra ID than the Microsoft Entra ID the file share is deployed in.
40-
- This is typical when you're managing multi-tenant environments. Using a default share-level permission allows you to bypass the requirement for a Microsoft Entra ID [hybrid identity](../../active-directory/hybrid/whatis-hybrid-identity.md). You can still use Windows ACLs on your files and directories for granular permission enforcement.
40+
- This is typical when you're managing multitenant environments. Using a default share-level permission allows you to bypass the requirement for a Microsoft Entra ID [hybrid identity](../../active-directory/hybrid/whatis-hybrid-identity.md). You can still use Windows ACLs on your files and directories for granular permission enforcement.
4141
- You prefer to enforce authentication only using Windows ACLs at the file and directory level.
4242

43-
> [!NOTE]
44-
> Because computer accounts don't have an identity in Microsoft Entra ID, you can't configure Azure role-based access control (RBAC) for them. However, computer accounts can access a file share by using a [default share-level permission](#share-level-permissions-for-all-authenticated-identities).
43+
## Azure RBAC roles for Azure Files
4544

46-
## Share-level permissions and Azure RBAC roles
45+
There are five built-in Azure role-based access control (RBAC) roles for Azure Files, some of which allow granting share-level permissions to users and groups. If you're using Azure Storage Explorer, you'll also need the [Reader and Data Access](../../role-based-access-control/built-in-roles.md#reader-and-data-access) role in order to read/access the Azure file share.
4746

48-
The following table lists the share-level permissions and how they align with the built-in Azure RBAC roles:
47+
> [!NOTE]
48+
> Because computer accounts don't have an identity in Microsoft Entra ID, you can't configure Azure RBAC for them. However, computer accounts can access a file share by using a [default share-level permission](#share-level-permissions-for-all-authenticated-identities).
4949
50-
|Supported built-in roles |Description |
50+
|**Built-in Azure RBAC role** |**Description** |
5151
|---------|---------|
5252
|[Storage File Data SMB Share Reader](../../role-based-access-control/built-in-roles.md#storage-file-data-smb-share-reader) |Allows for read access to files and directories in Azure file shares. This role is analogous to a file share ACL of read on Windows File servers. [Learn more](storage-files-identity-auth-active-directory-enable.md). |
5353
|[Storage File Data SMB Share Contributor](../../role-based-access-control/built-in-roles.md#storage-file-data-smb-share-contributor) |Allows for read, write, and delete access on files and directories in Azure file shares. [Learn more](storage-files-identity-auth-active-directory-enable.md). |
5454
|[Storage File Data SMB Share Elevated Contributor](../../role-based-access-control/built-in-roles.md#storage-file-data-smb-share-elevated-contributor) |Allows for read, write, delete, and modify ACLs on files and directories in Azure file shares. This role is analogous to a file share ACL of change on Windows file servers. [Learn more](storage-files-identity-auth-active-directory-enable.md). |
55+
|[Storage File Data Privileged Contributor](../../role-based-access-control/built-in-roles/storage.md#storage-file-data-privileged-contributor) |Allows read, write, delete, and modify ACLs in Azure file shares by overriding existing ACLs. |
56+
|[Storage File Data Privileged Reader](../../role-based-access-control/built-in-roles/storage.md#storage-file-data-privileged-reader) |Allows read access in Azure file shares by overriding existing ACLs. |
5557

5658
<a name='share-level-permissions-for-specific-azure-ad-users-or-groups'></a>
5759

@@ -64,7 +66,7 @@ If you intend to use a specific Microsoft Entra user or group to access Azure fi
6466
6567
In order for share-level permissions to work, you must:
6668

67-
- Sync the users **and** the groups from your local AD to Microsoft Entra ID using either the on-premises [Microsoft Entra Connect Sync](../../active-directory/hybrid/whatis-azure-ad-connect.md) application or [Microsoft Entra Connect cloud sync](../../active-directory/cloud-sync/what-is-cloud-sync.md), a lightweight agent that can be installed from the Microsoft Entra Admin Center.
69+
- If your AD source is AD DS or Microsoft Entra Kerberos, you must sync the users **and** the groups from your local AD to Microsoft Entra ID using either the on-premises [Microsoft Entra Connect Sync](../../active-directory/hybrid/whatis-azure-ad-connect.md) application or [Microsoft Entra Connect cloud sync](../../active-directory/cloud-sync/what-is-cloud-sync.md), a lightweight agent that can be installed from the Microsoft Entra Admin Center.
6870
- Add AD synced groups to RBAC role so they can access your storage account.
6971

7072
> [!TIP]
@@ -73,19 +75,16 @@ In order for share-level permissions to work, you must:
7375
You can use the Azure portal, Azure PowerShell, or Azure CLI to assign the built-in roles to the Microsoft Entra identity of a user for granting share-level permissions.
7476

7577
> [!IMPORTANT]
76-
> The share-level permissions will take up to three hours to take effect once completed. Please wait for the permissions to sync before connecting to your file share using your credentials.
78+
> The share-level permissions will take up to three hours to take effect once completed. Be sure to wait for the permissions to sync before connecting to your file share using your credentials.
7779
7880
# [Portal](#tab/azure-portal)
7981

8082
To assign an Azure role to a Microsoft Entra identity, using the [Azure portal](https://portal.azure.com), follow these steps:
8183

82-
1. In the Azure portal, go to your file share, or [create a file share](storage-how-to-create-file-share.md).
84+
1. In the Azure portal, go to your file share, or [create an SMB file share](storage-how-to-create-file-share.md).
8385
1. Select **Access Control (IAM)**.
8486
1. Select **Add a role assignment**
85-
1. In the **Add role assignment** blade, select the [appropriate built-in role](#share-level-permissions-and-azure-rbac-roles) from the **Role** list.
86-
1. Storage File Data SMB Share Reader
87-
1. Storage File Data SMB Share Contributor
88-
1. Storage File Data SMB Share Elevated Contributor
87+
1. In the **Add role assignment** blade, select the [appropriate built-in role](#azure-rbac-roles-for-azure-files) from the **Role** list.
8988
1. Leave **Assign access to** at the default setting: **Microsoft Entra user, group, or service principal**. Select the target Microsoft Entra identity by name or email address. **The selected Microsoft Entra identity must be a hybrid identity and cannot be a cloud only identity.** This means that the same identity is also represented in AD DS.
9089
1. Select **Save** to complete the role assignment operation.
9190

@@ -106,12 +105,12 @@ New-AzRoleAssignment -SignInName <user-principal-name> -RoleDefinitionName $File
106105

107106
# [Azure CLI](#tab/azure-cli)
108107

109-
The following CLI 2.0 command assigns an Azure role to a Microsoft Entra identity, based on sign-in name. For more information about assigning Azure roles with Azure CLI, see [Add or remove Azure role assignments using the Azure CLI](../../role-based-access-control/role-assignments-cli.md).
108+
The following CLI command assigns an Azure role to a Microsoft Entra identity, based on sign-in name. For more information about assigning Azure roles with Azure CLI, see [Add or remove Azure role assignments using the Azure CLI](../../role-based-access-control/role-assignments-cli.md).
110109

111110
Before you run the following sample script, remember to replace placeholder values, including brackets, with your own values.
112111

113112
```azurecli-interactive
114-
#Assign the built-in role to the target identity: Storage File Data SMB Share Reader, Storage File Data SMB Share Contributor, Storage File Data SMB Share Elevated Contributor
113+
#Assign the built-in role to the target identity: Storage File Data SMB Share Reader, Storage File Data SMB Share Contributor, Storage File Data SMB Share Elevated Contributor, Storage File Data Privileged Contributor, Storage File Data Privileged Reader
115114
az role assignment create --role "<role-name>" --assignee <user-principal-name> --scope "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Storage/storageAccounts/<storage-account>/fileServices/default/fileshares/<share-name>"
116115
```
117116
---
@@ -132,7 +131,7 @@ To configure default share-level permissions on your storage account using the [
132131

133132
:::image type="content" source="media/storage-files-identity-ad-ds-assign-permissions/set-default-share-level-permission.png" alt-text="Screenshot showing how to set a default share-level permission using the Azure portal." lightbox="media/storage-files-identity-ad-ds-assign-permissions/set-default-share-level-permission.png" border="true":::
134133

135-
1. Select the appropriate role to be enabled as the default [share permission](#share-level-permissions-and-azure-rbac-roles) from the dropdown list.
134+
1. Select the appropriate role to be enabled as the default [share permission](#azure-rbac-roles-for-azure-files) from the dropdown list.
136135
1. Select **Save**.
137136

138137
# [Azure PowerShell](#tab/azure-powershell)

0 commit comments

Comments
 (0)