Question

You are deploying FSLogix profile containers on an Azure Files share (SMB) joined to Active Directory Domain Services. Session hosts run in a pooled host pool, and profiles must be created and accessed only by the standard AVD users, while helpdesk administrators need full access for troubleshooting. According to Microsoft's recommended least-privilege configuration, which combination of Azure RBAC and NTFS permissions should you apply to the file share?

Accepted Answer

Assign the 'Storage File Data SMB Share Contributor' RBAC role to AVD users and 'Storage File Data SMB Share Elevated Contributor' to administrators, then set NTFS permissions so users have Modify on 'This folder only' with the creator owner inheriting subfolder ownership, and administrators have Full Control.

Answer

Assign the 'Storage File Data SMB Share Elevated Contributor' RBAC role to all AVD users, and grant them Full Control at the NTFS level on the share root.

Answer

Assign the 'Storage File Data SMB Share Reader' RBAC role to AVD users, and configure NTFS permissions granting users Read & Execute so containers remain immutable.

Answer

Skip Azure RBAC role assignments entirely and rely only on NTFS permissions, since Azure Files domain-joined shares ignore share-level RBAC for authentication.