How to audit azure fileshare delete modify etc. events when using Microsoft Entra Kerberos authentication

Question

How to audit azure fileshare delete modify etc. events when using Microsoft Entra Kerberos authentication

Agnes Compeau 20

Hello,

We are in a process of migrating our dept. shares to Azure Files and were under impression that our third-party tool can monitor the shares, however, it appeared that it can only monitor the shares when ADDS auth is being used. In our instance we need to have Microsoft Entra Kerberos auth turned on as we want to allow our Citrix users access to file shares from their local (domain joined) laptops without getting in through Citrix. Is there a way to setup basic auditing in this configuration? Please let me know

Agnes Compeau

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-17T16:12:39.55+00:00
Hello Agnes Compeau,

Yes, Azure Files supports access using Microsoft Entra Kerberos authentication. However, auditing works differently than on a traditional Windows file server.

Azure Files does not expose the underlying Windows Security Event Logs that many third-party auditing products rely on. If your auditing solution depends on those events, it may not be able to monitor activity when users access Azure Files directly using Microsoft Entra Kerberos authentication.

For Azure Files, Microsoft recommends using Azure Monitor by enabling Diagnostic Settings on the storage account and sending logs to Log Analytics, Storage, or Event Hub. These logs can be used to monitor Azure Files activity and access patterns.

For more information, see:

Azure Files identity-based authentication: https://learn.microsoft.com/azure/storage/files/storage-files-active-directory-overview

Azure Files monitoring data reference: https://learn.microsoft.com/azure/storage/files/storage-files-monitoring-reference

Could you let us know which auditing product you're using and whether you need auditing of specific file operations (such as create, modify, or delete) or general access tracking? That will help determine whether the available Azure Files logs meet your requirements.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-25T13:25:57.7633333+00:00

Hello Agnes Compeau,

Please confirm if you still have further queries on this
Agnes Compeau 20 Reputation points

2026-06-25T14:36:22.3666667+00:00
Could I please get some more detailed instructions on how to setup Azure Monitor Diagnostic Logs?

Enable Diagnostic Logs:

In your Storage Account, enable Azure Monitor Diagnostic Logs for the File service.

These logs capture “read” operations (such as GetFile, GetFileProperties, etc.).

You can then query the logs in Log Analytics to determine when a file was last accessed.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-26T09:57:18.7233333+00:00
Hello Agnes Compeau,

Certainly. You can configure Azure Monitor diagnostic logs for Azure Files by following these steps:

In the Azure portal, open your Storage account.

Navigate to File service > Monitoring > Diagnostic settings.

Select + Add diagnostic setting.

Enter a name for the diagnostic setting.

Under Logs, select allLogs or the individual categories (StorageRead, StorageWrite, and StorageDelete).

Under Destination details, select Send to Log Analytics workspace and choose your Log Analytics workspace.

Select Save.

After the logs begin flowing, you can query them in Log Analytics using Kusto Query Language (KQL). These logs record Azure Files storage operations, such as read, write, and delete requests, and can help you review access patterns and file activity.

Please note that Azure Files using Microsoft Entra Kerberos authentication does not generate Windows Security audit events or NTFS-style file auditing. The diagnostic logs capture storage service operations rather than detailed file system audit events.

Answer accepted by question author

0 additional answers

Your answer

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-17T16:12:39.55+00:00

Hello Agnes Compeau,

Yes, Azure Files supports access using Microsoft Entra Kerberos authentication. However, auditing works differently than on a traditional Windows file server.

Azure Files does not expose the underlying Windows Security Event Logs that many third-party auditing products rely on. If your auditing solution depends on those events, it may not be able to monitor activity when users access Azure Files directly using Microsoft Entra Kerberos authentication.

For Azure Files, Microsoft recommends using Azure Monitor by enabling Diagnostic Settings on the storage account and sending logs to Log Analytics, Storage, or Event Hub. These logs can be used to monitor Azure Files activity and access patterns.

For more information, see:

Azure Files identity-based authentication: https://learn.microsoft.com/azure/storage/files/storage-files-active-directory-overview

Azure Files monitoring data reference: https://learn.microsoft.com/azure/storage/files/storage-files-monitoring-reference

Could you let us know which auditing product you're using and whether you need auditing of specific file operations (such as create, modify, or delete) or general access tracking? That will help determine whether the available Azure Files logs meet your requirements.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-25T13:25:57.7633333+00:00

Hello Agnes Compeau,

Please confirm if you still have further queries on this
Agnes Compeau 20 Reputation points

2026-06-25T14:36:22.3666667+00:00

Could I please get some more detailed instructions on how to setup Azure Monitor Diagnostic Logs?

Enable Diagnostic Logs:

In your Storage Account, enable Azure Monitor Diagnostic Logs for the File service.

These logs capture “read” operations (such as GetFile, GetFileProperties, etc.).

You can then query the logs in Log Analytics to determine when a file was last accessed.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-26T09:57:18.7233333+00:00

Hello Agnes Compeau,

Certainly. You can configure Azure Monitor diagnostic logs for Azure Files by following these steps:

In the Azure portal, open your Storage account.

Navigate to File service > Monitoring > Diagnostic settings.

Select + Add diagnostic setting.

Enter a name for the diagnostic setting.

Under Logs, select allLogs or the individual categories (StorageRead, StorageWrite, and StorageDelete).

Under Destination details, select Send to Log Analytics workspace and choose your Log Analytics workspace.

Select Save.

After the logs begin flowing, you can query them in Log Analytics using Kusto Query Language (KQL). These logs record Azure Files storage operations, such as read, write, and delete requests, and can help you review access patterns and file activity.

Please note that Azure Files using Microsoft Entra Kerberos authentication does not generate Windows Security audit events or NTFS-style file auditing. The diagnostic logs capture storage service operations rather than detailed file system audit events.

Answer 1

Azure Files with Microsoft Entra Kerberos authentication doesn't change what the service logs at the platform level. For file operations such as delete, modify, and read, auditing is done via Azure Storage logging rather than NTFS-style on-premises file server auditing.

In this configuration, basic auditing can be achieved by enabling and querying diagnostic logs for the File service on the storage account:

Enable Azure Monitor diagnostic logs for the File service on the storage account.
Send these logs to a Log Analytics workspace.
Use Kusto queries over the File service logs to identify operations such as read, write, delete, and list, including which identity performed them and when.

These logs capture data-plane operations (for example, file reads and writes) and can be used to approximate “who deleted/modified/accessed what and when” even when Microsoft Entra Kerberos is used for SMB access.

Note that Azure Files doesn't expose a native "last accessed" timestamp on files or folders; only CreationTime, LastWriteTime, and ChangeTime are stored. For last access information, diagnostic logs must be used.

References: