Folder-Level Access Control in Azure Data Lake Storage Gen2

Quick Answer

The correct answer combines two different layers of access control because RBAC alone cannot achieve folder-level restriction in ADLS Gen2. The Storage Blob Data Contributor role is assigned at the storage account or container scope, and by itself it would grant read and write access across every folder in that container; it has no concept of one folder versus another. To narrow that down to a single directory, you layer POSIX-style ACLs on top, setting permission entries directly on the specific folder and its files. ACLs are the mechanism ADLS Gen2 inherited from its hierarchical namespace, and they operate independently of RBAC, checked in addition to it, which is what lets you combine a broad role assignment with a narrow, directory-specific restriction. This differs from trying to solve the problem with RBAC alone, since built-in roles like Storage Blob Data Contributor do not have folder-scoped variants; the granularity RBAC offers stops at the container level. Whenever a scenario describes needing access to one specific folder in a hierarchical namespace account without exposing sibling folders, that is a strong signal the answer involves setting ACLs at the directory level, typically alongside an RBAC role that establishes the baseline data-plane access needed before ACLs can even be evaluated.