I need to switch several Azure file shares to read-only. They contain millions of files and use existing NTFS permissions migrated from on-premises. The goal is not to make everything readable by everyone; each user should retain access only to the files and folders they can currently access, but anyone who currently has write access should be limited to reading. What is the safest and most efficient way to do this?
2 Answers
The approach depends on how clients authenticate. For identity-based SMB access, use the appropriate reader role rather than changing millions of files or rewriting their NTFS ACLs. If any access still relies on storage account keys or SAS tokens, those credentials can bypass the role-based design, so replace or revoke them and move users to identity-based access. Keep in mind that NTFS permissions still apply, so the result is the intersection of the share-level read-only permission and each user’s existing folder and file ACLs.
If access to the shares is controlled through Microsoft Entra ID roles, remove the Storage File Data SMB Share Contributor assignment and grant or retain Storage File Data SMB Share Reader instead. This changes the share-level capability to read-only while the existing NTFS permissions continue to control which files and folders each user can see and access. Test this on a representative share first, especially for users with different NTFS permissions.
That makes sense for the share-level permissions, but I still want to verify how the existing NTFS read and write permissions interact with the new reader role before applying it everywhere.