Creating ACLs using Storage Explorer and PowerShell

We use ACLs when we want to selectively give access to a set of directories and files to AAD users and groups in an ADLS Gen-2 storage account. Neither Azure built-in roles nor custom roles can't be used to restrict access at the directory/file level. Using ACL, we can provide access to specific directories and files in a container. Each file and directory in a Storage Account has an ACL.

Sets of permissions such as reading and writing can be granted to a security group in AAD, to an individual user on directories and files in an ADLS Gen-2 Storage Account, or to a container to restrict the access to the data that a user can see. You can't use an ACL to provide a level of access that is lower than a level granted by an Azure built-in role assignment (RBAC).

Getting ready

Before getting started, make sure you are the owner of the Storage Account or have Storage Blob Data Owner access to the storage account.

There...