File share in Azure for Azure AD (ONLY!) joined PCs

Michał Gębala 31

Is there any solution available in Azure (Storage account, VM, dedicated resource, 3rd party appliance) that will allow me to map a share on ONLY! Azure AD joined PC and will let me configure file/folder level permissions based on Azure AD accounts/groups?

0 comments

7 answers

Sumarigo-MSFT 47,601 Reputation points Microsoft Employee Moderator

2023-02-14T06:53:20.7333333+00:00

Updating the thread: General Availability: Azure Active Directory Kerberos with Azure Files for hybrid identities

General Availability of Azure Files integration with Azure Active Directory (Azure AD) Kerberos for hybrid identities. With this release, identities in Azure AD can mount and access Azure file shares without the need for line-of-sight to an Active Directory domain controller.

This article focuses on enabling and configuring Azure Active Directory (Azure AD) for authenticating hybrid user identities, which are on-premises AD DS identities that are synced to Azure AD. Cloud-only identities aren't currently supported.
Was this answer helpful?
Mike 25 Reputation points

2023-02-24T20:31:10.1433333+00:00

Will Cloud-only identities be supported in a future update? Thanks in advance!

joshadmin 11 Reputation points

2023-05-02T18:14:10.47+00:00

Also looking for an update on this. We want to use cloud-only identities to mount an Azure File Share, from a storage account that is setup for Azure AD DS auth.

TR 10 Reputation points

2023-05-30T03:11:54.92+00:00

Also wondering if/when Azure AD (DS) - only is going to happen.
Kind of mind-blowing that this is not available at the moment.

"You can use our cloud resources, but only if you also still have an on-premise environment!"

Aaron Berson 16 Reputation points

2023-06-12T19:15:16.5966667+00:00

CAn we get an update @Sumarigo-MSFT of if Azure AD cloud only identities will be supported? Really need this since the Onedrive Sync screws up Quickbooks Desktop files. Need a mounted drive that everyone accesses in real time and all users are cloud only and computers Azure AD joined..... any help here!

Christian Laboy 1 Reputation point

2024-01-17T22:19:52.1566667+00:00

@Sumarigo-MSFT There is an issue with your update. You state that share permissions no longer require line-of-sight to an on-prem active directory. What about folder/file level permissions? The guide you link to says that line-of-sight IS required.

EPNAdam 120 Reputation points

2025-05-20T14:25:52.8966667+00:00

Hi,

As many others here, are there any plans to rework Azure Files to support cloud only setups. In other words no AD, no AD DS but only Entra ID accounts and Intune enrolled devices.

I guess the SMB protocol is the limitation here but what everyone else is asking is an easy solution to get a "files-share" solution without the hassle of AD DS.

Looking at the Azure Updates no indications of it so another questions that pops up is if there are 3rd party options out there?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Sumarigo-MSFT 47,601 Reputation points Microsoft Employee Moderator

2022-06-10T12:24:48.66+00:00
@Michał Gębala Welcome t Microsoft Q&A Forum, Thank you for posting your query here!

For better understanding the scenario: As I understand instead of Using AADDS or ADDS, you want to use Azure AD for the authorization right?

If so we are working on this feature(Azure Files AAD authentication is in Private Preview), we have it in our pipeline. presently I don't have any ETA now. Get the latest updates on Azure products and features to meet your cloud investment needs. Subscribe to notifications to stay informed through Azure updates

Currently there are only 2 ways to configure an Azure Files share:

• Active Directory Domain Services Overview | Microsoft Learn
o Requires machines to be joined to the on premises domain. Most cases they would be Azure hybrid join.
• Overview of Azure Active Directory Domain Services | Microsoft Learn
o Requires the machine to be joined to the Azure AD Domain Services domain.

If a machine (either VM or physical machine) is joined to Azure AD, they would not be able to use either of these methods.

Additional information:

Supported scenarios and restrictions:
- AD DS Identities used for Azure Files on-premises AD DS authentication must be synced to Azure AD or use a default share-level permission. Password hash synchronization is optional.
- Supports Azure file shares managed by Azure File Sync.
- Supports Kerberos authentication with AD with AES 256 encryption (recommended) and RC4-HMAC. AES 128 Kerberos encryption is not yet supported.
- Supports single sign-on experience.
- Only supported on clients running on OS versions newer than Windows 7 or Windows Server 2008 R2.
- Only supported against the AD forest that the storage account is registered to. You can only access Azure file shares with the AD DS credentials from a single forest by default. If you need to access your Azure file share from a different forest, make sure that you have the proper forest trust configured, see the FAQ for details.
- Does not support authentication against computer accounts created in AD DS.
- Does not support authentication against Network File System (NFS) file shares.
- When you enable AD DS for Azure file shares over SMB, your AD DS-joined machines can mount Azure file shares using your existing AD DS credentials. This capability can be enabled with an AD DS environment hosted either in on-prem machines or hosted in Azure.
We strongly recommend you to review the How it works section to select the right domain service for authentication. The setup is different depending on the domain service you choose. These series of articles focus on enabling and configuring on-premises AD DS for authentication with Azure file shares.

If you are new to Azure file shares, we recommend reading our planning guide before reading the following series of articles.

Please let us know if you have any further queries. I’m happy to assist you further.

----------

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Was this answer helpful?

1 person found this answer helpful.
Michał Gębala 31 Reputation points

2022-06-10T16:19:11.177+00:00

hi correct, I'm looking for a solution where the only source of auth will be Azure AD without any requirements to have users synced from on-prem AD etc.
The same for devices and users (Azure AD only) Azure AD Kerberos looks promising but still doesn't give a perfect solution.
Does Azure provide any available solution for this currently like 3rd party NAS appliance or maybe there is a way to achieve it with a VM?
That would be a nice workaround until Azure Files AAD authentication reaches GA.

Sumarigo-MSFT 47,601 Reputation points Microsoft Employee Moderator

2022-06-11T11:10:29.3+00:00

@Michał Gębala No, Azure Files is the only thing that has any kind of integration at all with Azure AD, and only for newer client operating systems.
Since this feature will be available soon.

----------

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Tom Sweet 101 Reputation points

2023-10-03T18:03:55.6433333+00:00

@Sumarigo-MSFT

Hello,

Are there any updates for Entra ID only accounts/AD Joined computers?

We have six remote offices and assume Azure AD only. We would like to takes advantage of File Shares in addition to SharePoint.

LoganKeith-6543 15 Reputation points

2023-11-20T21:56:01.9233333+00:00

Also curious if there's an update to the ETA of this feature even if it's in preview. My organization would benefit greatly from this option and would eliminate many hoops for our end users to go through.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

File share in Azure for Azure AD (ONLY!) joined PCs

7 answers

Your answer