I'm setting up a proof of concept using Azure Files with FSLogix and Microsoft Entra Kerberos for identity. I followed the official configuration steps, including RBAC, the storage account, Entra Kerberos directory configuration, a private endpoint, updating the application manifest, and excluding MFA for the service principal. However, attempts to connect fail with a generic "wrong password" message. What configuration or troubleshooting steps might be missing?
3 Answers
Double-check the complete identity and networking path before troubleshooting FSLogix itself: validate the storage share RBAC assignments, DNS resolution through the private endpoint, session-host join status, and whether a CIFS Kerberos ticket can be obtained. A generic password error can be caused by any of those prerequisites failing.
Make sure the cloud Kerberos ticket retrieval policy is enabled on the session host. In policy settings, enable **Allow retrieving the Azure AD Kerberos Ticket Granting Ticket during logon** under `Computer Configuration > Administrative Templates > System > Kerberos`. The registry equivalent is `HKLMSYSTEMCurrentControlSetControlLsaKerberosParametersCloudKerberosTicketRetrievalEnabled` set to `1`.
That message often means the SMB client couldn’t complete Kerberos rather than the password actually being wrong. First confirm the session host is Entra joined or hybrid joined. Then try requesting a ticket with `klist get cifs/.file.core.windows.net`. Also verify that the private endpoint’s FQDN is included in the storage account’s Entra application configuration. Those checks should help distinguish a ticket, DNS, or permissions issue.
That was the missing setting in my case. After enabling it and signing in again, the connection worked. Thanks!