Entra ID Sync to Azure AD issue with File Server access

John K 0

I am having issues with users on Windows365 Entra Joined virtual Machines connecting to an Azure AD Domain Joined Server in Azure. The problem is that when logging into the VM, the file server shares will prompt for a username and password every time. The workaround for this is to add the credentials into Windows Credential Manager, which works until the end user tries to change thier password. This then locks the account out and completely removes the mapped network drive. I have tried to use Entra Cloud Sync/Entra Connect, but as the domain is in Azure, it will not allow me to create a user account that has the correct permissions for the Entra Sync/Connect service to run. since Entra cloud sync/connect is not able to run, i can't make the servers hybrid connect instead of entra connect which would in essense fix the issue.

Is there a way to get this to work correctly without completely turning off the ability to change a password?

Akhilesh Vallamkonda 11,360 Reputation points Microsoft Vendor

2025-01-21T22:33:55.28+00:00

Hi @John K

Thank you for post!

May I know where the file share is hosted? which type of user credentials was used while prompt for a username and password (cloud user or the on-prem user) and username format you are using.
How the users are configured to access the file server. if you have followed any article or document please do share.
John K 0 Reputation points

2025-01-22T13:18:22.62+00:00

The file share is stored on a Virtual Server in Azure, and is on the same subnet as the windows 11 machines but it is AD Joined (to a Entra Domain Services AD server). The credentials that are being used as of right now are just their email address and password, which are saved in credential manaager. and the shares are being accessed by mapped drives. I have gone through a bunch of microsoft learn documents as well as some 3rd party sites to get this figured out, but since the server is AD joined to an Entra Domain Services domain, a lot of the methods that i find (kerbose authentication using WHfB, Certificate Authentication) arnt really available since there isnt a way to make a domain admin account on that AD, so things like entra connect or setting up a kerbose computer in the domain doesnt work.
Akhilesh Vallamkonda 11,360 Reputation points Microsoft Vendor

2025-01-23T22:36:56.0433333+00:00

Hi @John K
Currently your ask is under Microsoft Entra ID tag Since your issue is with Azure File share will add the Azure File tag so the team will help on your issue.
Vinod Kumar Reddy Chilupuri 2,310 Reputation points Microsoft Vendor

2025-01-24T03:29:06.6066667+00:00
Hi @John K

Welcome to Microsoft Q&A, thanks for posting your query.

When dealing with Azure Files and Microsoft Entra Domain Services, it's important to ensure that the environment is set up correctly for authentication and access. Since your file share is hosted on a virtual server in Azure and is joined to an Entra Domain Services domain, you should be able to access the shares using Microsoft Entra credentials.

However, if you're facing issues with Kerberos authentication and other methods like Windows Hello for Business (WHfB) or Certificate Authentication, it’s crucial to note that Microsoft Entra Domain Services does not support creating domain admin accounts or certain advanced configurations that are available in on-premises Active Directory.

For accessing Azure file shares, ensure that:

The Windows 11 machines are domain-joined to the Entra Domain Services.

The credentials used for accessing the shares should be Microsoft Entra credentials (email and password).

You may need to check the synchronization settings between Microsoft Entra ID and Entra Domain Services, as only synchronized identities can be authenticated for Azure file share access.

However, it is possible that the private link FQDN (Fully Qualified Domain Name) is not registered to the existing Microsoft Entra application. This can cause issues with obtaining Kerberos tickets for accessing the file shares.

Kerberos authentication requires that the client and server have a shared secret, which is used to encrypt and decrypt messages between them. If the private link FQDN is not registered to the existing Microsoft Entra application, the client may not be able to obtain the necessary Kerberos tickets to access the file shares.

To resolve this issue, it is recommended to ensure that the private link FQDN is registered to the existing Microsoft Entra application.

If issues persist, consider reviewing the permissions and ensuring that the Azure Files service is configured to honor the role assignments granted to the synchronized identities.

https://learn.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview#how-it-works
Enable Microsoft Entra Domain Services authentication on Azure Files
https://learn.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview

Hope the above answer helps! Please let us know do you have any further queries.
Vinod Kumar Reddy Chilupuri 2,310 Reputation points Microsoft Vendor

2025-01-27T02:24:43.9933333+00:00

Hi @John K
Just checking to see that the above suggestion helped you to solve your query. If you have any further queries, please let us know. If this helps to solve your query do let us know.

Share via

Entra ID Sync to Azure AD issue with File Server access

Your answer