my external (non domain contractors) users cannot access file share

Question

I have external users (non domain) users unsuccessfully trying to access the file shares.

Answer 1

Hi Patram, Kevin,

When external users (non-domain users) are unable to access Azure file shares, especially in a scenario where access should be granted, several factors could be causing the issue. Here are some common reasons and troubleshooting steps which might help you to resolve the access issue.

• Review the Azure File Share configuration settings to ensure that it is set up to allow access from external users. Check the share settings, access control lists (ACLs), and security settings, see Share-level permissions for all authenticated identities
• Verify that the authentication mechanism allows external users to authenticate and access the file shares. Consider using Azure Active Directory (Azure AD) for authentication and ensure that external users are added as guest users in the Azure AD tenant.

Cause 1: Your user account doesn't have access to the storage account

Solution for cause 1

Browse to the storage account in which the Azure file share is located, select Access control (IAM), and verify that your user account has access to the storage account, see How to secure your storage account with Azure role-based access control (Azure RBAC).

Cause 2: Virtual network or firewall rules are enabled on the storage account

Solution for Cause 2

Verify that virtual network and firewall rules are configured properly on the storage account. To test if virtual network or firewall rules are causing the issue, temporarily change the setting on the storage account to Allow access from all networks, see Configure Azure Storage firewalls and virtual networks.

Cause 3: Share-level permissions are incorrect when using identity-based authentication

If users are accessing the Azure file share using identity-based authentication, access to the file share fails with the "Access is denied" error if share-level permissions are incorrect.

Solution for cause 3

Validate that share-level permissions are configured correctly. See Assign share-level permissions. Share-level permission assignments are supported for groups and users that have been synced from AD DS to Microsoft Entra ID using Microsoft Entra Connect Sync or Microsoft Entra Connect cloud sync. Confirm that groups and users being assigned share-level permissions aren't unsupported "cloud-only" groups.

The username or password is incorrect" error after a customer-initiated failover

In a customer-initiated failover scenario with geo-redundant storage accounts, file handles and leases aren't retained on failover. Clients must unmount and remount the file shares.

Error "No access" when you try to access or delete an Azure file share

When you try to access or delete an Azure file share using the Azure portal, you might receive the following error:

No access Error code: 403

Note: Non-domain-joined VMs can access Azure file shares using Microsoft Entra Domain Services authentication only if the VM has unimpeded network connectivity to the domain controllers for Microsoft Entra Domain Services. Usually this requires either site-to-site or point-to-site VPN.

Reference: https://learn.microsoft.com/en-us/troubleshoot/azure/azure-storage/files/connectivity/files-troubleshoot-smb-connectivity?tabs=windows

---

Please do not forget to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.           

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.