Known Limitations

Consider the following limitations when you use the Ranger ABFS plugin:

• Hierarchical namespace is required: ACL operations fail for storage accounts that do not have HNS enabled.

• Superuser access bypasses ACLs: Principals with Storage Blob Data Owner or Storage Blob Data Contributor roles bypass ACL checks. This includes the plugin service principal when it has the required administrator role. Use a principal without an RBAC data role when testing access-denied scenarios.

• RBAC changes require time to propagate: New Azure role assignments can take several minutes before Azure CLI or plugin operations succeed.

• ADLS limits the number of ACL entries: ADLS supports a maximum of 32 access entries and 32 default entries per item. Configuring many named principals can reach this limit.

• ADLS uses an allow-only model: ADLS does not provide deny ACL entries. Therefore, Ranger deny permissions cannot be represented as explicit ADLS deny permissions. Access is denied when no applicable grant exists.

• Recursive ACL application operates on each node: Applying ACLs recursively requires an API call for each node and can take longer for large directory trees.

• Partial failures are logged: Ranger logs individual ACL failures as warnings. After applying ACLs recursively to a large directory tree, review ranger_admin.log for failures.