We have a Windows Server 2022 virtual machine in Azure that acts as an application server and hosts two SMB shares. Our Windows 365 Cloud PCs are Microsoft Entra-joined and have network access to the virtual network containing the server. We want the shares to map automatically when users sign in. Microsoft Entra Domain Services is enabled and synchronized with Microsoft Entra ID. What should we check to get authentication and automatic drive mapping working?
3 Answers
With Microsoft Entra Domain Services, you do not manage the domain controllers directly, so guidance written for customer-managed AD domain controllers may not apply exactly. Confirm that the managed domain is healthy, secure LDAP or Kerberos requirements are not being blocked by network rules, and that the Cloud PCs are actually joined to or able to authenticate against the managed domain. If the goal is only drive mapping, deploy the mapping through Intune or a sign-in script after Kerberos access is working; automatic mapping alone will not fix an authentication or DNS problem.
Start by checking the basics from the Cloud PC: it should resolve the file server and domain controllers through the Microsoft Entra Domain Services DNS servers, and it needs connectivity to the domain controllers—not only TCP 445 to the file server. Kerberos requires access to the directory services. Test the share with its fully qualified name, such as \server.domain.localshare, then run `klist` and check whether a CIFS ticket for that hostname is issued. Also verify that the server share and NTFS permissions include the users or groups from the managed domain.
If users sign in with Windows Hello or another passwordless method, investigate Cloud Kerberos Trust. Microsoft Entra-joined devices can use SSO to SMB shares on domain-joined servers, but the Kerberos trust and synchronization pieces must be configured correctly. Make sure the Cloud PCs can reach the managed domain, use the correct DNS configuration, and that the users have synchronized identities and usable credentials in the managed domain.
Both directory servers are provided as part of Microsoft Entra Domain Services rather than being traditional domain controllers that we manage ourselves. Does that change how Cloud Kerberos Trust should be configured?