Microsoft Entra Kerberos- setup

reza admin 140 Reputation points
2026-08-08T21:26:23.96+00:00

Hello

We have a hybrid environment where our most user accounts are created in our on-prem AD and then those accounts as well as their password are synced to our Entra ID. We also have 2 different domain , internal and external

We would like to enable Microsoft Entra Kerberos in our Azure to use it for our Azure file share access etc but are worried about the consequences . Can we just simply Turn it on?

Thanks in advance.

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments

1 answer

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-08-08T21:26:52.24+00:00

    Yes, Microsoft Entra Kerberos can be enabled for Azure Files in a hybrid environment, but it should be done with a few checks first rather than treated as a no-impact toggle.

    What enabling it does:

    • Microsoft Entra ID acts as a cloud-based Kerberos Key Distribution Center (KDC).
    • Hybrid users synced from on-prem AD DS to Microsoft Entra ID can get Kerberos tickets for Azure file shares.
    • This helps users access Azure Files without requiring direct line of sight to on-prem domain controllers for authentication.

    Important consequences and limits:

    1. Only one identity source can be enabled on a storage account for identity-based authentication with Azure Files.
      • If a storage account is already configured for another Azure Files identity source, Microsoft Entra Kerberos is not an additive switch on that same account.
      • Supported alternatives mentioned are on-prem AD DS or Microsoft Entra Domain Services, but the configuration steps and supported scenarios differ.
    2. Hybrid identity is supported.
      • Accounts created in on-prem AD and synced to Microsoft Entra ID are a supported scenario.
    3. Cloud-only support exists for some workloads.
      • Cloud-only identities can use Kerberos authentication for workloads like Azure Files.
    4. File and folder permission management has a dependency for hybrid identities.
      • For hybrid identities, configuring Windows ACLs and directory/file-level permissions requires unimpeded network connectivity to the on-prem domain controller.
      • If using File Explorer for permission configuration, the domain name and domain GUID from on-prem AD are needed.
    5. If a cloud trust design is being considered, only forest trusts are supported for Azure Files.
      • The context does not state support details for using two separate domains beyond that note.

    So the practical answer is:

    • Yes, it can be turned on for Azure Files in a hybrid synced environment.
    • No, it should not be turned on blindly without first confirming what identity source is already configured on the target storage account and how permissions will be managed.

    Safe rollout path:

    1. In Azure portal, open the target storage account.
    2. Go to Data storage > Classic file shares.
    3. Open Identity-based access.
    4. Verify whether an identity source is already configured.
    5. If none is configured and Microsoft Entra Kerberos matches the requirement, select Set up under Microsoft Entra Kerberos, check the box, and save.
    6. If hybrid users will need directory and file-level permissions managed through Windows File Explorer, gather the on-prem AD domain name and domain GUID first by running Get-ADDomain from an AD-joined client.

    If using automation instead of the portal:

    • Azure CLI: 
        az storage account update --name <storageaccountname> --resource-group <resourcegroupname> --enable-files-aadkerb true
    • Azure PowerShell: 
        Set-AzStorageAccount -ResourceGroupName <resourceGroupName> -StorageAccountName <storageAccountName> -EnableAzureActiveDirectoryKerberosForFile $true

    For the two-domain concern:

    • The provided material confirms hybrid identities are supported and states that only forest trusts are supported for Azure Files in cloud trust scenarios.
    • It does not provide broader impact guidance for a two-domain design beyond that.
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.