Summary
When MyWorkDrive uses an Azure File Share as storage, users may be unable to delete, overwrite, or save changes to certain files. The cause is the Windows Read-only attribute set on those files in the Azure File Share. Azure enforces this attribute even for connections made with a storage account connection string, which otherwise has full control of the share. Clearing the attribute resolves the issue.
1. What users experience
A user attempts to delete a file, upload a new version over an existing file, or save edits to a file, and the action fails. The MyWorkDrive logs or error details show an error similar to the following:
System.Exception: The specified resource is read-only and cannot be modified at this time.
RequestId:1063edc9-601a-0085-4969-4c718d000000
Time:2026-09-24T21:13:28.9437912Z
Status: 409 (The specified resource is read-only and cannot be modified at this time.)
ErrorCode: ReadOnlyAttribute
Content:
Headers:
Server: Windows-Azure-File/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 1063edc9-601a-0085-4969-4c718d000000
x-ms-client-request-id: c00522d6-40d0-47f0-a85a-d329ba6603e0
x-ms-version: 2025-11-05
x-ms-error-code: ReadOnlyAttribute
Date: Thu, 24 Sep 2026 21:13:28 GMT
Content-Length: 258
Content-Type: application/xml
The key identifiers are Status: 409 and ErrorCode: ReadOnlyAttribute. Other files in the same share, in the same folder, and with the same permissions typically work normally. Only the files carrying the attribute are affected.
2. What causes it
Files in an Azure File Share keep their Windows (SMB) file attributes, such as Read-only, Hidden, and Archive. These attributes are part of the file itself and are separate from NTFS permissions.
A storage account connection string authenticates with the storage account key. That key bypasses NTFS permissions (ACLs) entirely, which is why a connection string is normally described as having full control. It does not bypass the Read-only attribute. Azure Files refuses to modify or delete any file with the Read-only attribute set, regardless of how the request is authenticated, and returns the 409 ReadOnlyAttribute error instead.
In short:
- NTFS permissions control who can access a file. The connection string ignores them.
- The Read-only attribute is a property of the file itself. Azure enforces it for every caller, including the connection string.
Common ways files end up with the attribute:
- Migration from an on-premises file server. Tools such as robocopy, AzCopy (when preserving SMB properties), and Azure File Sync can carry file attributes over from the source. Files that were read-only on the old server arrive read-only in Azure.
- Set by a user or application over SMB. Anyone with the share mapped in Windows can check Read-only in a file's Properties dialog, and some applications set the attribute on files they create.
The error message is specific to this cause. Other conflicts, such as a file being open by an SMB client or an active lease, return different error codes (for example SharingViolation or a lease-related error).
3. How to test for it
Prerequisites
These steps use PowerShell and the Microsoft Az.Storage module. Each command is a single line.
- Open PowerShell.
- Allow modules to load in this session and install Az.Storage. If prompted about the NuGet provider or an untrusted repository, answer Y.
powershell
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force; [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Install-Module Az.Storage -Scope CurrentUser -Force -AllowClobber
- Get the connection string from the Azure portal: open the storage account, go to Security + networking > Access keys, click Show next to Connection string, and copy it. Treat it like a password.
- Connect, replacing CONNECTION-STRING with the value copied above (keep the quotation marks):
powershell
$ctx = New-AzStorageContext -ConnectionString "CONNECTION-STRING"
A yellow warning that a newer version of Az is available is informational and can be ignored.
In the commands below, replace SHARE-NAME with the file share name, and folder/file.txt with the path to the file inside the share. Use forward slashes and do not include the share name in the path.
Check whether a file has the Read-only attribute
This command only reads the file's attributes and changes nothing.
powershell
$f = (Get-AzStorageFile -ShareName "SHARE-NAME" -Path "folder/file.txt" -Context $ctx).ShareFileClient; $f.GetProperties().Value.SmbProperties.FileAttributes
- If the output includes ReadOnly (for example ReadOnly, Archive), the attribute is the cause.
- If it does not include ReadOnly, the error has a different cause.
- A ResourceNotFound error means the share name or path does not match the file. Check spelling, slashes, and the file extension.
Reproduce the issue by setting the attribute on a test file
Use this to reproduce the error on a test file. It adds ReadOnly to the file's existing attributes and then prints the result, which should now include ReadOnly.
powershell
$A = [Azure.Storage.Files.Shares.Models.NtfsFileAttributes]; $f = (Get-AzStorageFile -ShareName "SHARE-NAME" -Path "folder/file.txt" -Context $ctx).ShareFileClient; $p = $f.GetProperties().Value.SmbProperties; $p.FileAttributes = ($p.FileAttributes -bor $A::ReadOnly) -band -bnot $A::None; $o = New-Object Azure.Storage.Files.Shares.Models.ShareFileSetHttpHeadersOptions; $o.SmbProperties = $p; [void]$f.SetHttpHeaders($o); $f.GetProperties().Value.SmbProperties.FileAttributes
Attempting to delete or overwrite the file, whether through MyWorkDrive or directly with the command below, now fails with 409 ReadOnlyAttribute.
powershell
Remove-AzStorageFile -ShareName "SHARE-NAME" -Path "folder/file.txt" -Context $ctx
Note that if the attribute is not set, this command deletes the file. Only run it against a test file.
4. How to fix it
Clearing the Read-only attribute resolves the error. Only the attribute is changed. File contents, other attributes, and NTFS permissions are left as they are.
Complete the prerequisites in section 3 first.
Fix a single file
powershell
$A = [Azure.Storage.Files.Shares.Models.NtfsFileAttributes]; $f = (Get-AzStorageFile -ShareName "SHARE-NAME" -Path "folder/file.txt" -Context $ctx).ShareFileClient; $p = $f.GetProperties().Value.SmbProperties; $p.FileAttributes = $p.FileAttributes -band -bnot $A::ReadOnly; if ($p.FileAttributes -eq 0) { $p.FileAttributes = $A::None }; $o = New-Object Azure.Storage.Files.Shares.Models.ShareFileSetHttpHeadersOptions; $o.SmbProperties = $p; [void]$f.SetHttpHeaders($o); $f.GetProperties().Value.SmbProperties.FileAttributes
The output should no longer include ReadOnly. Retry the action in MyWorkDrive.
Find all read-only files in a storage account (report only)
Before making bulk changes, you can list every file with the attribute across all file shares in the storage account. This makes no changes.
powershell
$A = [Azure.Storage.Files.Shares.Models.NtfsFileAttributes]; function Scan($d) { foreach ($i in $d.GetFilesAndDirectories([Azure.Storage.Files.Shares.Models.ShareDirectoryGetFilesAndDirectoriesOptions]::new())) { if ($i.IsDirectory) { Scan $d.GetSubdirectoryClient($i.Name) } else { $f = $d.GetFileClient($i.Name); if ($f.GetProperties().Value.SmbProperties.FileAttributes -band $A::ReadOnly) { "Read-only: $($f.ShareName)/$($f.Path)" } } } }; Get-AzStorageShare -Context $ctx | ForEach-Object { Scan $_.ShareClient.GetRootDirectoryClient() }; "Finished"
Fix all files in a storage account
This walks every file share in the storage account and clears the Read-only attribute from every file that has it. Files that do not have the attribute are not modified. Each fixed file is listed as Cleared, and Finished is displayed at the end.
powershell
$A = [Azure.Storage.Files.Shares.Models.NtfsFileAttributes]; function Fix($d) { foreach ($i in $d.GetFilesAndDirectories([Azure.Storage.Files.Shares.Models.ShareDirectoryGetFilesAndDirectoriesOptions]::new())) { if ($i.IsDirectory) { Fix $d.GetSubdirectoryClient($i.Name) } else { $f = $d.GetFileClient($i.Name); $p = $f.GetProperties().Value.SmbProperties; if ($p.FileAttributes -band $A::ReadOnly) { $p.FileAttributes = $p.FileAttributes -band -bnot $A::ReadOnly; if ($p.FileAttributes -eq 0) { $p.FileAttributes = $A::None }; $o = New-Object Azure.Storage.Files.Shares.Models.ShareFileSetHttpHeadersOptions; $o.SmbProperties = $p; [void]$f.SetHttpHeaders($o); "Cleared: $($f.ShareName)/$($f.Path)" } } } }; Get-AzStorageShare -Context $ctx | ForEach-Object { Fix $_.ShareClient.GetRootDirectoryClient() }; "Finished"
To limit the fix to one share, replace Get-AzStorageShare -Context $ctx with Get-AzStorageShare -Name "SHARE-NAME" -Context $ctx.
Notes:
- Both the scan and the fix check every file individually. On shares with many files they can take a long time and generate storage transactions. Leave the PowerShell window open until Finished appears.
- If a file is open by an SMB client, clearing the attribute may fail with a SharingViolation error. Close the file and run the command again.
- If you see an error about an overload or a missing type, update the module with Update-Module Az.Storage and open a new PowerShell window.
Alternative: fix over SMB
If the share is mapped on a Windows machine, the attribute can also be cleared there, either by unchecking Read-only in the file's Properties dialog, or from a command prompt:
attrib -R "\\STORAGEACCOUNT.file.core.windows.net\SHARE-NAME\folder\file.txt"
To clear the attribute from every file in a folder and its subfolders:
attrib -R "\\STORAGEACCOUNT.file.core.windows.net\SHARE-NAME\folder\*" /S
Preventing recurrence
When migrating data into Azure Files with robocopy, add /A-:R to remove the Read-only attribute from files as they are copied. For data already migrated, run the scan above after the migration completes and clear any read-only files it finds.