I need to switch several Azure file shares containing millions of files from read/write to read-only. Different users currently have different NTFS permissions, and the goal is for each person to retain access to the same files they can currently read or modify, but with all write operations disabled. What is the safest and most efficient approach without rewriting the existing NTFS ACLs?
2 Answers
If access is controlled through Azure RBAC, replace the Storage File Data SMB Share Contributor role with Storage File Data SMB Share Reader at the appropriate scope. That should remove share-level write access while leaving the existing NTFS permissions in place. Make sure you are changing the data-plane SMB role, not a management role.
For users authenticating through account keys or SAS tokens, those credentials may still allow access outside the intended reader role. In that case, revoke or rotate the credentials and move the users to Azure AD-based authentication with the Reader role. Before applying the change everywhere, test it on one share with representative users to confirm that existing NTFS allow and deny entries combine with the new share-level read-only restriction as expected.
The most important part is testing the interaction between the share-level Reader role and the migrated NTFS ACLs. The RBAC change should prevent writes, but it’s worth verifying both allowed reads and users who were previously denied access.
The shares use IAM for share access, but they also have NTFS permissions from an on-premises migration. I’m mainly trying to confirm how those ACLs behave after the RBAC change.