I have a Windows Server 2022 VM in Azure that hosts an application and two SMB file shares. Users sign in to Microsoft Entra-joined Windows 365 Cloud PCs, and I want those shares to map automatically when they log in. The Cloud PCs can reach the VNet containing the server. The environment uses Microsoft Entra Domain Services with synchronization to Microsoft Entra ID. Where should I start troubleshooting, particularly around DNS, Kerberos, authentication, and drive mapping?
2 Answers
Start by confirming that each Cloud PC uses the correct Active Directory DNS servers and can resolve both the file server and the domain controllers. Network access to TCP 445 alone is not enough—Kerberos also needs connectivity to the domain controllers and the required AD-related ports. Try opening the share with its fully qualified name, such as \server.domain.localshare, rather than an IP address or short hostname. Then run `klist` and check whether a `cifs/server.domain.local` Kerberos ticket is being issued. If users sign in with Windows Hello or another passwordless method, also verify that the appropriate Cloud Kerberos Trust configuration is in place.
Microsoft Entra-joined devices can generally use single sign-on to SMB shares hosted by domain-joined servers, so the arrangement should be possible. I would troubleshoot it in this order: verify DNS resolution from the Cloud PC, confirm connectivity to the Entra Domain Services domain controllers, test the share by FQDN, and inspect the Kerberos tickets with `klist`. Only after that would I focus on the login script or policy that maps the drives. If Kerberos is not available, the mapping may prompt for credentials or fail even though the server is reachable.
Both directory servers are managed through Microsoft Entra Domain Services rather than being customer-managed domain controllers. Does that change whether Cloud Kerberos Trust can be configured?