Trouble enabling Entra Kerberos as identity source for Azure files

“Operation is forbidden” occurs while Azure updates the storage account, before client-side Kerberos settings are used. Check the failed entry in the storage account Activity log first; its authorization details should distinguish RBAC, a resource lock, Policy, or a tenant restriction.

Confirm that the setup account has a management-plane role containing Microsoft.Storage/storageAccounts/write, such as Storage Account Contributor or Contributor, at the storage-account or parent scope. Azure Files data roles are not sufficient. Also check for a ReadOnly lock, deny assignment, or Azure Policy denial.

Only one Azure Files identity source can be enabled per storage account. Disable AD DS or Microsoft Entra Domain Services first if either is already configured.

The domain name and domain GUID are optional for Microsoft Entra Kerberos. They are needed for hybrid identities only when managing ACLs through File Explorer. As an isolation test, enable the feature without those values:

az storage account update --name <account> --resource-group <group> --enable-files-aadkerb true

If that succeeds, obtain DNSRoot and ObjectGUID from Get-ADDomain; do not use the Entra tenant ID as the domain GUID.

If it still returns 403, ask the Entra administrator to check application-management policies. The Storage Resource Provider must be allowed to create the storage-account service principal and its symmetric credential. After enablement, grant admin consent to the generated application and assign share-level RBAC permissions.