Context
Azure Files identity-based SMB access uses two authorization layers. Share-level permissions allow entry to the share, while Windows access control lists govern the root directory and its contents. A user can pass one check and still receive Access denied when opening a folder.
Prerequisites are the configured identity source, exact user or service identity, share path and failing operation. Confirm basic SMB connectivity first. Keep an approved administrative method for reading permissions, but preserve a separate test using the ordinary user's identity. Storage account key access does not validate that user's authorization.
1. Identify the actual SMB principal
Inspect the signed-in account and existing SMB connections on the affected client. Cached connections can use different credentials than expected. Record whether authentication uses AD DS, Microsoft Entra Domain Services or Microsoft Entra Kerberos, then verify the prerequisites for that source.
Distinguish users, groups, service logon accounts and computer accounts. Their Microsoft Entra representation can differ. Assigning a role to a similarly named directory object does not prove it matches the SMB principal. Compare identifiers and the documented identity mapping rather than display names alone.
2. Review the share-level grant
Inspect direct and inherited role assignments. Select an SMB data role appropriate to the required operation. A management Reader role does not permit file reads. A data role permitting reads does not necessarily permit writing, deleting or changing ACLs.
If the account uses a default share-level permission, document its effect on all authenticated identities. This can support specific identity designs, but directory ACLs then provide the granular restrictions. Allow documented propagation time when evaluating a newly assigned role. Keep the original error evidence so a later successful test is attributable to the correction.
3. Inspect the directory permission chain
Read the ACL on the share root, relevant parent directories and affected file. Check inheritance, effective group membership and deny entries. A permission on a child does not settle whether the user can traverse its parents. Compare the actual operation because reading a document and creating one in its parent require different rights.
On an authorized Windows client, icacls without modification switches can inspect a narrowly selected UNC path. Avoid recursive permission replacement as a diagnostic shortcut. Correct the intended group or inheritance boundary through the normal review process, keeping unrelated directory permissions intact.
Diagnostic checkpoints
| Observation | Likely boundary | Next evidence |
|---|---|---|
| Key access works, user fails | Identity authorization | Principal and data role |
| Share opens, folder fails | Directory ACL | Parent and child entries |
| Read works, create fails | Operation-specific rights | Share role and folder write |
| Only one client differs | Cached authentication | SMB connection context |
Illustrative scenario
A hypothetical project group receives an SMB Share Contributor role, but a migrated folder retains an ACL for an obsolete directory group. Users reach the share and cannot open that folder. Checking both layers identifies the mismatch without giving every user broad control. This is a fictional permission example, not a reported migration outcome.
Verification and permissions SOP
Test as an ordinary member of the intended group with a fresh supported authentication context. Verify required reads and writes and an operation that should remain denied. Administrator success is not sufficient evidence of user access.
Document share roles, default grants and folder owners in the SOP. Review permissions after identity-source changes and migrations, when obsolete identifiers can survive copying. Monitor authorization failures and require a scoped review before large inheritance changes. Preserve a record of effective permissions for representative folders so subsequent access incidents can be compared with an approved baseline.
Explore Clouvenix cloud security for implementation and operational handover.