Azure Files
An Azure service that offers file shares in the cloud.
1,382 questions
How to access azure file shares with domain credentials from Domain joined machines over internet
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(284.8, 23%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ES%3C/text%3E%3C/svg%3E)
Sivaram
0
Reputation points
Currently using Cache servers with AFS and planning to remove cache servers and access Azure File shares directly. What changes I need to made on existing storage accounts to support Microsoft Entra Kerberos authentication. User identites are hybrid and devices are entra ID hybrid
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(307.2, 85%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESA%3C/text%3E%3C/svg%3E)
Syed Aaqid Ali 335 Reputation points Microsoft External Staff2025-03-10T18:18:15.7566667+00:00 Hi Sivaram,
To access Azure file shares with domain credentials from Domain joined machines over the internet using Microsoft Entra Kerberos authentication, you may need to ensure that your Azure storage account is configured correctly. Highly recommend checking the Prerequisites. Below are the steps which would be helpful.
Enable Microsoft Entra Kerberos Authentication: You must enable Microsoft Entra Kerberos authentication for your Azure file shares. This requires that your user identities are hybrid and that your devices are Microsoft Entra hybrid joined.
Storage Account Configuration: Ensure that your Azure storage account is not configured to authenticate with both Microsoft Entra ID and another method like Active Directory Domain Services (AD DS) or Microsoft Entra Domain Services. If it is, you will need to disable the other authentication method.
User Accounts: The accounts must be hybrid user identities, meaning they should be created in Active Directory and synced to Microsoft Entra ID using either Microsoft Entra Connect or Microsoft Entra Connect cloud sync.
Disable MFA: Microsoft Entra Kerberos does not support multi-factor authentication (MFA) for accessing Azure file shares. You will need to exclude the Microsoft Entra app representing your storage account from MFA conditional access policies.
Network Connectivity: For configuring directory and file-level permissions, you will need unimpeded network connectivity to an on-premises Active Directory.
Operating System Requirements: Ensure that the client machines are running compatible operating systems, such as Windows 11 Enterprise/Pro.
References:
- Enable Microsoft Entra Kerberos authentication for hybrid identities on Azure Files
- Overview of Azure Files identity-based authentication for SMB access
Please do not forget to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.
-
Syed Aaqid Ali 335 Reputation points Microsoft External Staff
2025-03-11T22:32:48.09+00:00 Hi Sivaram,
Checking to see whether you have resolved the issue with the solution provided above, or if you need any further assistance, please let us know.
-
Syed Aaqid Ali 335 Reputation points Microsoft External Staff
2025-03-12T21:05:12.9433333+00:00 Hello Sivaram,
I wanted to follow up and see if the solution proposed helped (pointed you in the right direction) > please do not forget to “up-vote”. which might be beneficial to other community members reading this thread. And, if you have any further queries do let us know.
Sign in to comment
Sign in to answer