Originally reported by mspoweruser.com. Announced by Microsoft at Black Hat conference, Las Vegas.
Overview
At Black Hat 2019 in Las Vegas, Microsoft announced a set of security enhancements for Azure Files focused on tightening access control. The updates center on Azure Active Directory Domain Services (Azure AD DS) authentication for Server Message Block (SMB) access, NTFS discretionary access control list (DACL) enforcement, new built-in RBAC roles, and a more accessible permission management experience through File Explorer.
Azure AD DS Authentication for SMB Access
The headline feature is Azure AD DS authentication support for SMB access to Azure Files. Domain-joined Windows virtual machines can now mount and access Azure file shares over SMB using AD DS credentials, with NTFS access control lists (ACLs) enforced at the file and folder level.
This makes Azure Files a stronger option for enterprise lift-and-shift scenarios. Because the permission assignment and enforcement model mirrors standard NTFS behavior, migrating an on-premises SMB file server workload to Azure Files requires minimal changes to access control configuration. Administrators can use the same mental model and tooling they already know.
Microsoft specifically called out Windows Virtual Desktop as a key use case: it recommends Azure Files for hosting user profiles, leveraging Azure AD DS authentication for access control.
Granular Permissions: Share, File, and Folder Level
Azure AD DS authentication for Azure Files enables granular permission assignments at the share, file, and folder levels. This unblocks common enterprise scenarios such as:
- Single writer, multi-reader: Line-of-business applications that require one principal to write while multiple others read from the same share.
- Shared storage for cloud-based services: Azure Files becomes a viable shared storage backend for cloud-native or migrated workloads that previously depended on on-premises SMB shares.
NTFS DACL Enforcement and Preservation
Azure Files now strictly enforces NTFS Discretionary Access Control Lists (DACLs). A key operational benefit is that these DACLs are preserved across data movement and recovery workflows:
- Data migration with Robocopy: Because Azure Files enforces NTFS DACLs, tools like
Robocopycan move data into an Azure file share while persisting all security controls — no manual ACL re-application required after migration. - Snapshots and backup: Azure Files access control lists are captured in file share snapshots. This means services like Azure Backup, which leverages file snapshots, preserve ACLs through backup and disaster recovery operations.
Three New Built-In RBAC Roles for Share-Level Access
To simplify share-level access management, Microsoft introduced three new built-in Azure RBAC roles specifically for Azure Files SMB access:
| Role | Purpose |
|---|---|
| Storage File Data SMB Share Reader | Read-only access to the file share over SMB |
| Storage File Data SMB Share Contributor | Read, write, and delete access over SMB |
| Storage File Data SMB Share Elevated Contributor | Read, write, delete, and modify NTFS permissions over SMB |
These built-in roles remove the need to create custom roles for standard share-level permission patterns, reducing administrative overhead and the risk of misconfiguration.
Permission Management Through File Explorer
Previously, viewing and modifying permissions on Azure Files required the Windows command-line tool icacls. While functional, icacls is not easily discoverable, and its usage is inconsistent with how most users expect to manage file permissions on Windows.
This capability was first previewed at Microsoft Ignite 2018. With this update, permission management is now available directly through File Explorer, bringing the experience in line with standard Windows file permission workflows. Administrators and end users familiar with the Windows Security tab can now assign and modify Azure Files permissions without dropping to a command line.
Planned Extension to On-Premises Windows Server Active Directory
At the time of announcement, Azure AD DS authentication was the supported identity source for Azure Files SMB access control. However, Microsoft stated that the Azure Files team was actively working to extend authentication support to Windows Server Active Directory hosted on-premises or in the cloud.
This planned extension is important for organizations that have not yet moved their identity infrastructure to Azure AD DS and rely on traditional on-premises AD for authentication. It signals Microsoft’s intent to make Azure Files a drop-in replacement for on-premises SMB file servers regardless of the identity topology in use.
Summary of Key Improvements
- Azure AD DS authentication for SMB access to Azure Files, with enforced NTFS ACLs
- Granular share-, file-, and folder-level permission control
- NTFS DACL preservation during Robocopy migrations and Azure Backup snapshot-based recovery
- Three new built-in RBAC roles (Reader, Contributor, Elevated Contributor) for share-level access management
- File Explorer support for permission assignment, replacing the command-line-only
icaclsapproach - Planned support for on-premises Windows Server Active Directory authentication
Together, these changes make Azure Files a significantly more viable enterprise storage platform for organizations migrating SMB workloads to Azure, particularly where maintaining existing access control structures and familiar management tooling is a requirement.