diff --git a/internal/db/role.go b/internal/db/role.go
index ae62a8ed..808a6f5f 100644
--- a/internal/db/role.go
+++ b/internal/db/role.go
@@ -34,6 +34,14 @@ func GetRoles(pageIndex, pageSize int) (roles []model.Role, count int64, err err
 	return roles, count, nil
 }
 
+func GetAllRoles() ([]model.Role, error) {
+	var roles []model.Role
+	if err := db.Find(&roles).Error; err != nil {
+		return nil, errors.WithStack(err)
+	}
+	return roles, nil
+}
+
 func CreateRole(r *model.Role) error {
 	if err := db.Create(r).Error; err != nil {
 		return errors.WithStack(err)
diff --git a/internal/db/user.go b/internal/db/user.go
index 8f1c28b9..4e5d67ad 100644
--- a/internal/db/user.go
+++ b/internal/db/user.go
@@ -83,6 +83,14 @@ func GetUsers(pageIndex, pageSize int) (users []model.User, count int64, err err
 	return users, count, nil
 }
 
+func GetAllUsers() ([]model.User, error) {
+	var users []model.User
+	if err := db.Find(&users).Error; err != nil {
+		return nil, errors.WithStack(err)
+	}
+	return users, nil
+}
+
 func DeleteUserById(id uint) error {
 	return errors.WithStack(db.Delete(&model.User{}, id).Error)
 }
diff --git a/internal/op/storage.go b/internal/op/storage.go
index 27221e70..dfb305aa 100644
--- a/internal/op/storage.go
+++ b/internal/op/storage.go
@@ -41,6 +41,18 @@ func GetStorageByMountPath(mountPath string) (driver.Driver, error) {
 	return storageDriver, nil
 }
 
+func firstPathSegment(p string) string {
+	p = utils.FixAndCleanPath(p)
+	p = strings.TrimPrefix(p, "/")
+	if p == "" {
+		return ""
+	}
+	if i := strings.Index(p, "/"); i >= 0 {
+		return p[:i]
+	}
+	return p
+}
+
 // CreateStorage Save the storage to database so storage can get an id
 // then instantiate corresponding driver and save it in memory
 func CreateStorage(ctx context.Context, storage model.Storage) (uint, error) {
@@ -267,6 +279,34 @@ func DeleteStorageById(ctx context.Context, id uint) error {
 	if err != nil {
 		return errors.WithMessage(err, "failed get storage")
 	}
+	firstMount := firstPathSegment(storage.MountPath)
+	if firstMount != "" {
+		roles, err := db.GetAllRoles()
+		if err != nil {
+			return errors.WithMessage(err, "failed to load roles")
+		}
+		users, err := db.GetAllUsers()
+		if err != nil {
+			return errors.WithMessage(err, "failed to load users")
+		}
+		var usedBy []string
+		for _, r := range roles {
+			for _, entry := range r.PermissionScopes {
+				if firstPathSegment(entry.Path) == firstMount {
+					usedBy = append(usedBy, "role:"+r.Name)
+					break
+				}
+			}
+		}
+		for _, u := range users {
+			if firstPathSegment(u.BasePath) == firstMount {
+				usedBy = append(usedBy, "user:"+u.Username)
+			}
+		}
+		if len(usedBy) > 0 {
+			return errors.Errorf("storage is used by %s, please cancel usage first", strings.Join(usedBy, ", "))
+		}
+	}
 	if !storage.Disabled {
 		storageDriver, err := GetStorageByMountPath(storage.MountPath)
 		if err != nil {