Azure File Sync now
offers two dedicated,
built-in RBAC roles, designed to enhance security and operational efficiency
for businesses managing file synchronization across on-premises and cloud
environments. These new roles, Azure File Sync Administrator and Azure
File Sync Reader provide more granular access control compared to broad
roles like Owner and Contributor, empowering organizations to enforce the
principle of least privilege.
To meet company-specific compliance and governance
requirements, organizations previously needed to create custom roles for Azure
File Sync administrators to ensure appropriate permission levels when assigning
roles to other users. With this update, Azure introduces a set of purpose-built
roles that simplify this process by providing tailored permissions that grant
users the ability to create and manage components such as a Storage Sync
Service, Sync Group, Server Endpoint, Cloud Endpoint, and register servers with
Azure File Sync all while adhering to the principle of least privilege. Importantly,
these roles do not grant permissions to create or manage virtual machines and
only provide read access to storage accounts, enhancing both security and
operational efficiency without overextending access.