services / Azure / Storage file service

The file service of a storage account exposes SMB/NFS file shares and its control-plane properties (CORS, share soft-delete/retention, SMB protocol and security settings). The data-plane holds organizational file data.

Backup-semantics privileges (SeBackupPrivilege/SeRestorePrivilege equivalents) bypass per-file NTFS/share ACLs.

Microsoft.​Storage/​storageAccounts/​fileServices/​generateUserDelegationKey/​action

Returns a user delegation key, cryptographic material that can sign user-delegation SAS tokens granting direct data-plane access to file shares under a delegated credential, enabling pivot to data access.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links