enable ad ds authentication for your azure file shares

If you have ever explored the differences between Active Directory (AD DS) and Azure Active Directory (Azure AD), you would have found that Azure Active Directory doesn't support the Kerberos authentication protocol, but Active Directory does. This will create a computer account in your on-premises AD called onprem1sa to represent the Azure storage account and join the storage account to the domain. Until now, Azure Files supported identity-based authentication over Server Message Block (SMB) through two types of Domain Services: on-premises Active Directory Domain Services (AD DS) and Azure Active Directory Domain Services (Azure AD DS). Enable AD DS authentication on the storage account associated with Forest 1, for example onprem1sa.

Now you need to give the relevant permissions to a user or group the necessary permissions at the share level. With this release, identities in Azure AD can mount and access Azure file shares without the need for line-of-sight to an Active Directory domain controller. Once this has been created you need go into the configuration under settings and enable ‘Azure Active Directory Domain Services’ under the ‘Identity-based access for file shares’ section. When you enable AD authentication for the storage account, it applies to all new and existing Azure file share (s).

We are excited to announce Azure Files integration with Azure Active Directory (Azure AD) Kerberos for hybrid identities. The process of enabling your Active Directory authentication for Azure Files is to join the storage account that you used to create the file share to your Active Directory.

Enable ad ds authentication for your azure file shares