services / Azure / Storage file service

The file service of a storage account exposes SMB/NFS file shares and its control-plane properties (CORS, share soft-delete/retention, SMB protocol and security settings). The data-plane holds organizational file data.

Backup-semantics privileges (SeBackupPrivilege/SeRestorePrivilege equivalents) bypass per-file NTFS/share ACLs.

Microsoft.​Storage/​storageAccounts/​fileServices/​runAsBuiltInFileAdministrator/​action

Grants built-in file-administrator (superuser) access for share mounts via managed identity, bypassing all share/file ACLs to read, modify, and fully control every file in the shares.

Risks

1. Data escalation (CRITICAL)
2. Data exfiltration (CRITICAL)
3. Data manipulation (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links