Azure Files not honoring ACLs/NTFS

In your scenario #3, it appears that the issue arises from the way NTFS permissions are being evaluated in conjunction with the permissions assigned to "Authenticated Users." When you changed the ACL for "Authenticated Users" from "Modify" to "Read/List," it restricted access for any users that fall under that category, including your identity if it is part of the "Authenticated Users" group.

Here are some key points to consider:

1. NTFS Permissions Hierarchy: NTFS permissions are cumulative, meaning that if a user belongs to multiple groups, they inherit permissions from all those groups. If "Authenticated Users" had previously granted modify permissions, changing it to read/list could restrict access for users who are part of that group, even if they have explicit permissions assigned through IAM or NTFS.
2. Explicit vs. Inherited Permissions: If your identity is explicitly granted permissions but is also part of a group that has restricted permissions (like "Authenticated Users"), the most restrictive permission will apply. In this case, since "Authenticated Users" is set to read/list, it overrides the explicit permissions you assigned.
3. Testing with Different User Accounts: To isolate the issue, you could test with a user account that is not part of the "Authenticated Users" group to see if the explicit NTFS permissions work as expected. This will help determine if the group membership is affecting access.
4. Consider Using More Granular Permissions: If you need to maintain the ability for specific users to modify files while restricting general access, consider creating a dedicated group for those users and assigning permissions accordingly, rather than relying on "Authenticated Users."
5. Debugging Tools: Utilize the Debug-AzStorageAccountAuth command to verify that the permissions are being applied as expected and that there are no underlying issues with the authentication or authorization process.

In summary, the behavior you're experiencing in scenario #3 is likely due to the interaction between the NTFS permissions and the group memberships. Adjusting the permissions for "Authenticated Users" or using more granular permissions for specific users may resolve the issue.

References:

• Configure directory and file-level permissions for Azure file shares
• Enable Microsoft Entra Kerberos authentication for hybrid and cloud-only identities (preview) on Azure Files
• Troubleshoot Azure Files identity-based authentication and authorization issues (SMB)

Hello @Jim J,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand your question. It looks like you’re navigating a tricky issue with Azure Files not honoring NTFS permissions under your Entra Kerberos setup. Based on what you described, here are some thoughts and troubleshooting steps for your scenario:

Understanding Scenario #3

From your configuration, it sounds like your IAM permissions are correctly set up, as has been verified by the success of your Debug-AzStorageAccountAuth command. However, since modifying the "Authenticated Users" ACL from "Modify" to "Read/List" leads to access issues, it seems like the ACL inheritance or precedence rules might be coming into play here.

Key Points to Consider

1. ACL Precedence**: The rule in place here is that if multiple permissions are applied, the most restrictive one takes effect. When you change "Authenticated Users" to have "Read/List," it's possible that your specific identity still does not have sufficient NTFS permissions, thereby restricting create/delete operations.
2. Review Effective Permissions**: You might want to check the effective permissions for your identity on the affected folder. This can be done by examining both IAM permissions and NTFS permissions together, as conflicting permissions can cause unexpected behavior.
3. Non-Propagation of Permissions**: Ensure that permissions are applied correctly and recursively. Sometimes, files and folders inherit permissions from parent directories unless inheritance is explicitly disabled.

Suggested Steps

Check Effective Permissions: Use the Effective Permissions feature in Windows to see what your actual permissions are on the specific file or folder.

Reconfigure ACLs: Test changing back the "Authenticated Users" permission to "Modify" and observe if that resolves the issue. If it does, carefully reintroduce your intended permissions while monitoring the effective permissions.

Use Diagnostic Tools: Utilize tools and resources provided in the documentation to troubleshoot access issues and ACL configurations in Azure Files.

Additional Resources:

https://learn.microsoft.com/en-us/troubleshoot/azure/azure-storage/blobs/authentication/storage-troubleshoot-403-errors

https://learn.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-access-control#access-control-lists-on-files-and-directories

https://learn.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-directory-file-acl-dotnet?tabs=azure-ad

If the issue occurs still, please share the below asked details for further troubleshoot.

1. Can you confirm if "Authenticated Users" permission is being inherited from a parent folder?
2. Have you checked the effective permissions for your identity in the specific folder where you're facing issues?
3. Are there any conflicting permissions set at a higher level that might be affecting access?

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have any questions about this answer, please click "Comment".