services / Azure / Storage File Service Files

Files and folders stored within an Azure Files share inside a storage account. This is the data plane of the file share, holding the actual organizational file data.

Production file shares commonly hold sensitive business documents, application config, and home-directory data; data-plane access grants direct read/write/delete of that content.

Microsoft.​Storage/​storageAccounts/​fileServices/​fileShares/​files/​write

Creates/overwrites files and folders, letting an attacker tamper with organizational data and overwrite files with encrypted content for ransomware extortion.

Risks

1. Data encryption (CRITICAL)
2. Data manipulation (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links