Azure Files identity configuration with entra domain services issue

Question

Azure Files identity configuration with entra domain services issue

YMCA2838382 0

I will configure it (both through powershell and through azure GUI) and it will either have strange issues where it won't map on a joined vm (or I can't change permissions)... or it will let me do those things (sometimes) but then 20 minutes later it will revert back to 'not configured'. this is apart of a migration and is critical - i have 2 days to complete it and this is one of the last items. Please let me know what I can do to resolve this. I've found this in other threads and a 'bug' was mentioned...

Priya ranjan Jena 2,295 Reputation points Microsoft External Staff Moderator

2025-10-29T12:29:41.8966667+00:00

Hi YMCA2838382,

Welcome to Microsoft Q&A forum.

Could you please share any error screenshot & any error details if you have any?

Thanks
YMCA2838382 0 Reputation points

2025-10-29T13:05:34.6066667+00:00

there aren't any errors funny enough. If I click 'set up' on the storage account for identity based entra domain services - it seems to turn on with out a hitch. but 20 minutes later it will revert to 'not configured'. If I run powershell commands to join it (ive tried two different ways):

join-azstorageaccount & set-azstorageaccount

they both work but I won't be able to map the drive and it reverts back to 'not configured'

there have been moments where it worked and I could set permissions but the time was very limited
YMCA2838382 0 Reputation points

2025-10-29T13:10:52.7+00:00

Also to be clear - this is a strorageaccount that has 3 shares that are also by synced with an on prem file server that is still the production file server. so the azure files shares are not production and no one has been cutover to them.

1 answer

Your answer

Priya ranjan Jena 2,295 Reputation points Microsoft External Staff Moderator

2025-10-29T12:29:41.8966667+00:00

Hi YMCA2838382,

Welcome to Microsoft Q&A forum.

Could you please share any error screenshot & any error details if you have any?

Thanks
YMCA2838382 0 Reputation points

2025-10-29T13:05:34.6066667+00:00

there aren't any errors funny enough. If I click 'set up' on the storage account for identity based entra domain services - it seems to turn on with out a hitch. but 20 minutes later it will revert to 'not configured'. If I run powershell commands to join it (ive tried two different ways):

join-azstorageaccount & set-azstorageaccount

they both work but I won't be able to map the drive and it reverts back to 'not configured'

there have been moments where it worked and I could set permissions but the time was very limited
YMCA2838382 0 Reputation points

2025-10-29T13:10:52.7+00:00

Also to be clear - this is a strorageaccount that has 3 shares that are also by synced with an on prem file server that is still the production file server. so the azure files shares are not production and no one has been cutover to them.

Answer 1

Hi YMCA2838382,

Thanks for the reply, we have some below suggestions for you, hope that works

Review Permissions: Ensure that you have the necessary permissions granted to your Azure AD users. Check if the users involved have roles like Storage File Data Owner or Storage File Data Contributor, which are crucial for accessing the files properly.

The identity used for Join-AzStorageAccount or Set-AzStorageAccount must have Storage Account Contributor and Directory Join permissions in Entra ID.

Verify Synchronization: Since you mentioned syncing with an on-premises file server, confirm that the synchronization is happening correctly. If you're using Microsoft Entra Connect, make sure it is configured to synchronize password hashes.

Use Correct Sign-in Format: When signing in or mapping the drives, try using the UPN format (i.e., ******@domain.com) rather than SAMAccountName

As you mentioned storage account that has 3 shares that are also by synced with an on prem file server, please ensure your VM must be domain-joined to Microsoft Entra Domain Services. For more information about how to domain-join a VM, see Join a Windows Server virtual machine to a managed domain. Microsoft Entra Domain Services authentication over SMB with Azure file shares is supported only on Windows VMs running OS versions above Windows 7 or Windows Server 2008 R2, or on Linux VMs running Ubuntu 18.04+ or an equivalent RHEL or SLES VM.

Reference link:https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-domain-services-enable?tabs=azure-portal

DNS Configuration

The VNet linked to the storage account must use the AAD DS DNS servers. If DNS reverts to Azure default or custom DNS without the domain controllers, the Kerberos setup breaks. You can follow some of the below steps to verify

Verify DNS Settings Ensure DNS servers point to AAD DS IPs.

   PowerShell
   Get-AzVirtualNetwork -Name <VNetName> -ResourceGroupName <RGName>

Re-run Join with Kerberos Key

   PowerShell
   Join-AzStorageAccount `
   -ResourceGroupName <RGName> `
   -Name <StorageAccountName> `
   -DomainName <AADDSDomainName> `
   -OrganizationalUnit <OUPath> `
   -AccountType Computer

3.Enable Azure Files AD DS Authentication

PowerShell
Set-AzStorageAccount `
-ResourceGroupName <RGName> `
-Name <StorageAccountName> `
-EnableAzureActiveDirectoryDomainServicesForFile $true

4.validate Kerberos Status

PowerShell
Get-AzStorageAccount `
-ResourceGroupName <RGName> `
-Name <StorageAccountName> `
| Select-Object AzureFilesIdentityBasedAuthentication

Hope, you find this comment helpful, if yes, please “up-vote” for the information provided , this can be beneficial to community members.

Kindly let us know if you have any additional questions.

Thanks

Share via

Azure Files identity configuration with entra domain services issue

1 answer

Your answer