services / Azure / Storage File Service Files

Files and folders stored within an Azure Files share inside a storage account. This is the data plane of the file share, holding the actual organizational file data.

Production file shares commonly hold sensitive business documents, application config, and home-directory data; data-plane access grants direct read/write/delete of that content.

Microsoft.​Storage/​storageAccounts/​fileServices/​fileShares/​files/​read

Returns file/folder contents and directory listings, enabling both exfiltration of stored file data and enumeration of stored objects.

Risks

1. Data exfiltration (CRITICAL)
2. Data discovery (LOW)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links