Separate new-child inheritance from existing Data Lake ACL remediation

Source facts

Data Lake Storage keeps an item’s permissions on that item. A directory’s default ACL supplies inheritance when a child is created; changing the default afterward does not update existing children. Existing access ACLs and default ACLs therefore require their own review.

When access is granted only through ACLs, a file reader or writer also needs Execute permission on the container root and every intervening directory. That qualification matters when testing the resulting access path. Microsoft Learn.

Applicability

Apply this distinction to ACL-based directory permissions. Identify the caller and authorization route before testing, and record any broader role grants rather than assuming an access result came from the ACL alone.

DSE recommendation

DSE recommends separating the change request into future-child defaults and the explicitly approved existing-child population. Inventory both before making changes. Have the data owner specify intended access for each population, and preserve the original ACLs so an incorrect broad change can be investigated and reversed deliberately.

Verification

Use a controlled directory containing a preexisting file, then create a second file after the default change. Compare the stored permissions and actual authorized-user access for both. Check directory traversal separately, and include an unintended user in the denial test. Retain object paths and ACL evidence without copying sensitive file contents.

Official references

Microsoft Learn: Access control lists (ACLs) in Azure Data Lake Storage. Source retrieved September 9, 2026.