I don't have on-premises Active Directory Domain Services or domain controllers. My users and Windows PCs are managed through Microsoft Entra ID, and I want them to access an Azure Files SMB share such as \storageaccount.file.core.windows.netshare.
The requirements are:
- No on-premises AD
- No storage account keys
- No PowerShell scripts or net use commands
- Access through File Explorer or Map Network Drive
- Ideally, authentication using each user's Entra ID identity rather than manually entering a key
Can Microsoft Entra Kerberos for Azure Files support this setup on Entra-joined Windows devices?
2 Answers
Follow the Microsoft configuration guidance closely and test it with a small group first. Configure share-level and directory-level permissions with Entra users or groups, and remove unnecessary inherited access where appropriate. Also deploy the required client registry settings through device management rather than relying on manual changes. If the share is private, every endpoint needs network connectivity to the Azure virtual network, usually through a VPN or another private-access solution.
Yes, this is supported with Microsoft Entra Kerberos for Azure Files, including scenarios without traditional on-premises AD. You need to configure identity-based authentication on the storage account and share, prepare the Entra-joined Windows clients, and deploy the required client configuration or registry settings. After that, users can access the share through File Explorer or Map Network Drive using their signed-in Windows identity.
The setup is easy to confuse with hybrid authentication. Some Azure Files Kerberos configurations do require AD DS or synchronization, but the Entra Kerberos option is designed for supported Entra-joined devices and cloud identities. Check the current Microsoft prerequisites carefully before deploying.