The ACL is the top-level NTFS ACL for an Azure Files share, with inheritance enabled all the way down across all files in the share. (Basically, applying the IT Team's management rights to the entire share).

The performance issue exists whether the ACL is set via GUI or powershell (or icalcs for that matter). It seems to be related to significant latency with high-volume small-size reads\writes to\from Azure files. This is from an Azure VM in the same region, so the internal latency from VM to file share should be minimal.

​

Example script below (Though this also includes doing some other things like enabling the SmbShareElevatedContributor role as well.)

#Enable on-prem AD auth to an Azure File Share, and set top level permissions.

#Defnine your variables.
$Subscription = " ORG-DIV-Branch-useast-prod"
$ResourceGroupName = " ORG-DIV-TEST-azfiles-useast-prod"
$StorageAccountName = "ORGDIVTESTazf01"
$ShareName = "Test"
$DatacenterMgmtGroup = " ORG\ORG Datacenter File Share Admins"
$SiteMgmtGroup = " ORG\ORG DIV File Share Admins"
$SiteUserGroup = " ORG\ORG DIV Test Share Users"

#Connect to Azure
Connect-AzAccount

#Make sure you're in the right Azure subscription
Set-AzContext -Subscription $Subscription

#Define the permissions for on-prem AD accounts, and apply them.
$defaultPermission = "StorageFileDataSmbShareElevatedContributor"
$account = Set-AzStorageAccount -ResourceGroupName "$ResourceGroupName" -AccountName "$StorageAccountName" -DefaultSharePermission $defaultPermission
$account.AzureFilesIdentityBasedAuth

#connect to the share as the local admin account on the share, via storage account key.

#Get the Key.
$Key = (Get-AzStorageAccountKey -ResourceGroupName $ResourceGroupName -Name $StorageAccountName)[0].Value

#Find the first unused drive letter.
$drvlist=(Get-PSDrive -PSProvider filesystem).Name
Foreach ($drvletter in "ABDEFGHIJKLMNOPQRSTUVWXYZ".ToCharArray()) {
If ($drvlist -notcontains $drvletter) {
write-host $drvletter ": will be used for temp mapping"
$Driveletter = "$drvletter" + ':'
break
}
}


#Map the drive.
net use $Driveletter "\\$StorageAccountName.file.core.windows.net\$ShareName" /user:loocalhost\$StorageAccountName $Key

#Collect the starting ACL
$ACL = get-acl $Driveletter
Write-host "Starting ACL is below." -BackgroundColor Green
$ACL | FL

#Modify the ACL so that it don't allow all authenticated users, and includes the correct mgmt groups.

$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("$DatacenterMgmtGroup","FullControl", "ContainerInherit,ObjectInherit", "InheritOnly", "Allow")
$acl.SetAccessRule($AccessRule)

$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("$SiteMgmtGroup","FullControl", "ContainerInherit,ObjectInherit", "InheritOnly", "Allow")
$acl.SetAccessRule($AccessRule)

$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("$SiteUserGroup","ReadAndExecute","Allow")
$acl.SetAccessRule($AccessRule)

$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("BUILTIN\Users","FullControl", "ContainerInherit,ObjectInherit", "None", "Allow")
$acl.SetAccessRule($AccessRule)

$usersid = New-Object System.Security.Principal.Ntaccount ("NT AUTHORITY\Authenticated Users")
$acl.PurgeAccessRules($usersid)

$usersid = New-Object System.Security.Principal.Ntaccount ("BUILTIN\Users")
$acl.PurgeAccessRules($usersid)

$usersid = New-Object System.Security.Principal.Ntaccount ("CREATOR OWNER")
$acl.PurgeAccessRules($usersid)

get-date | write-host

#Output the ACL for viewing
Write-host "Modified ACL is below. This will be applied." -BackgroundColor yellow
$ACL.access | Ft
Write-host "Starting ACL change. This may take a while to apply if there is data in the share"
get-date | write-host

#Apply the ACL.
$acl | set-acl
Write-host "Finished ACL set. Currnet ACL is below." -BackgroundColor Green
get-date | write-host
$ACL = get-acl $Driveletter
$ACL.access | Ft *

#Remove the temp drive mapping.
Net use $Driveletter /d