services / Azure / Storage file service

The file service of a storage account exposes SMB/NFS file shares and its control-plane properties (CORS, share soft-delete/retention, SMB protocol and security settings). The data-plane holds organizational file data.

Backup-semantics privileges (SeBackupPrivilege/SeRestorePrivilege equivalents) bypass per-file NTFS/share ACLs.

Microsoft.​Storage/​storageAccounts/​fileServices/​readFileBackupSemantics/​action

Backup-semantics read privilege bypasses per-file ACLs to read any file/directory contents in the share, enabling broad data exfiltration regardless of normal permissions.

Risks

1. Data exfiltration (CRITICAL)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links