its very strange that Microsoft document is not clear about the step to create a new ACL entry in the existing blobs existing directory without modifying any existing ACL entry. My aim here is to create new Security principal on timely requirement and also sometimes need to update permission of existing security principal.

Not understading, how to achieve the below point mentioned in the docs.

• if you are using auth-mode as login, as mentioned in the documentation you need have storage blob data owner role

  az storage fs access set --acl "user:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx:rwx" -p <directorypath>  -f <filesystemname> --account-name <datalakestorageaccount> --auth-mode login

Here is the sample output for reference :

You can refer this documentation for more sample examples & usage of az storage fs access set cmdlet.