How to limit a specific file share in from Azure storage account with multiple file shares from being mapped on windows

Question

How do I restrict a specific file share to Azure from being mapped on windows explorer. Limiting the ability to map specific file share to specific AD group.

Answer 1

Hello Shane,

Thank you for posting your query here!

To restrict a specific file share in Azure from being mapped on Windows Explorer and limit the ability to map a specific file share to a specific AD group, you can follow these steps:

Assign share-level permissions to specific Microsoft Entra users or groups. This is the most stringent and secure configuration. You can assign them to specific Microsoft Entra users/groups, and you can assign them to all authenticated identities as a default share-level permission.

After you assign share-level permissions, you can configure Windows access control lists (ACLs), also known as NTFS permissions, at the root, directory, or file level. While share-level permissions act as a high-level gatekeeper that determines whether a user can access the share, Windows ACLs operate at a more granular level to control what operations the user can do at the directory or file level.

Also, if your organization uses Active Directory, you can use Group Policy to map network drives and configure restrictions. This allows you to control which AD groups can map specific file shares.

I hope this helps! Please let me know if you have any other questions or need further clarification.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.  

Answer 2

Hi Shane,

If you are referring to using NTFS permissions please refer to the documentation:

Configure directory and file-level permissions over SMB

https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-configure-permissions

You also need to ensure you have the proper share-level permissions set up:

Assign share-level permissions

https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-assign-permissions?tabs=azure-portal

If this is helpful please accept answer.