Can Azure Files SMB Use Microsoft Entra ID Without On-Premises Active Directory?

Yes, this can be supported with Microsoft Entra Kerberos for Azure Files, but it is not simply a username-and-password prompt for any Windows computer. The storage account must be configured for Entra Kerberos, the users need the appropriate Azure Files permissions, and the Windows clients need the required Entra Kerberos configuration—often including specific policy or registry settings. Test the exact client and join-state requirements in a lab before deploying it broadly.

Network access still matters. SMB requires connectivity to the Azure Files endpoint, and port 445 is commonly blocked by residential or restrictive networks. For remote users, you may need a VPN, private connectivity, or another supported network design. You can use public access with suitable restrictions, but a private endpoint requires clients to have a route into the Azure virtual network.

Be careful with older documentation: some Entra Kerberos Azure Files scenarios required identities synchronized from on-premises AD or Microsoft Entra Domain Services. Microsoft also supports newer cloud-only identity scenarios, but availability and prerequisites depend on the authentication model and feature support in your tenant. Confirm that your users and Entra-connected devices meet the current Microsoft requirements rather than assuming every Entra-only setup will work.

Also configure both share-level and directory-level permissions. Assign the appropriate Azure Files data roles to Entra users or groups, then apply NTFS-style ACLs to folders where you need more granular control. Consider private access, SMB security settings, key rotation, and Azure Backup after authentication is working.