Can I Mount an Azure Files SMB Share Using Only Entra ID Credentials?
Asked by
MellowCedar42
I don't have on-premises Active Directory Domain Services or domain controllers. My users and Windows PCs are managed through Microsoft Entra ID, and I want them to access an Azure Files SMB share such as \storageaccount.file.core.windows.netshare.
The requirements are:
- No on-premises AD
- No storage account keys
- No PowerShell scripts or net use commands
- Access through File Explorer or Map Network Drive
- Ideally, authentication using each user's Entra ID identity rather than manually entering a key
Can Microsoft Entra Kerberos for Azure Files support this setup on Entra-joined Windows devices?
Answers
Yes, this is supported with Microsoft Entra Kerberos for Azure Files, including scenarios without traditional on-premises AD. You need to configure identity-based authentication on the storage account and share, prepare the Entra-joined Windows clients, and deploy the required client configuration or registry settings. After that, users can access the share through File Explorer or Map Network Drive using their signed-in Windows identity.
Reply to this answer
Follow the Microsoft configuration guidance closely and test it with a small group first. Configure share-level and directory-level permissions with Entra users or groups, and remove unnecessary inherited access where appropriate. Also deploy the required client registry settings through device management rather than relying on manual changes. If the share is private, every endpoint needs network connectivity to the Azure virtual network, usually through a VPN or another private-access solution.
Reply to this answer
Network access can be the bigger problem for remote users. SMB normally uses TCP 445, and some residential or public networks block it. A private endpoint combined with a VPN or suitable secure network path is often more reliable than exposing the storage account publicly. Regardless of the access model, use least-privilege permissions, secure SMB settings, backups, and key rotation as defense-in-depth.
Reply to this answer
Add your answer
Answers are reviewed before publication.
NorthwindLime8: The setup is easy to confuse with hybrid authentication. Some Azure Files Kerberos configurations do require AD DS or synchronization, but the Entra Kerberos option is designed for supported Entra-joined devices and cloud identities. Check the current Microsoft prerequisites carefully before deploying.