Share via

Issues mapping Azure file share using Entra Kerberos

Chase Griffin 0 Reputation points
2025-12-03T16:56:00.8666667+00:00

So our scenario is that we are testing mapping Azure File Shares using only Entra credentials.

I've set up a storage account and file share, configured identity based access for Entra Kerberos, and followed all of the instructions in this knowledgebase article:

https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable?tabs=azure-portal%2Cregkey#grant-admin-consent-to-the-new-service-principal

  • Granted admin consent
  • Excluded the storage account from CA
  • Updated the manifest of the Storage account
  • Enabled kerberos retrieval on the client

When I attempt to map the drive using Net Use, it automatically gives me a credential error and then prompts for credentials. If I enter the credentials, I get an error 1326.

Does anyone know what could be causing this/what I'm doing wrong?

Azure Storage
Azure Storage
Globally unique resources that provide access to data management services and serve as the parent namespace for the services.

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vallepu Venkateswarlu 1,065 Reputation points Microsoft External Staff Moderator
    2025-12-03T17:00:10.2266667+00:00

    Hi @ Chase Griffin,
    Welcome to Microsoft Q&A Platform

    It sounds like you're running into some issues mapping Azure File Shares using Entra Kerberos authentication. This can be a bit tricky, so let's walk through a few things that might help resolve the credential error and the error code 1326 you're encountering.

    Here are some steps you can try:

    1. Double-Check Permissions:
      • Ensure that the role assigned to your user account includes the necessary permissions to interact with the Azure File Shares. You could try assigning the Storage File Data Privileged Reader or Storage File Data Privileged Contributor roles.
    2. MFA Configuration:
      • If your organization uses Multi-Factor Authentication (MFA), ensure that you've excluded the Microsoft Entra app corresponding to your storage account from any conditional access policies. Otherwise, it can lead to sign-in issues when mapping the share.
    3. Private Link Configuration:
      • If you're using a private endpoint for your storage account, make sure that the private link FQDN is registered in your Microsoft Entra application. Any entry pointing to <storageAccount>.file.core.windows.net should also have a corresponding entry for <storageAccount>.privatelink.file.core.windows.net in the identifierUris field of the app registration.
    4. Network Configuration:
      • Check if the necessary ports (especially port 445 for SMB) are open on your network setup, as issues here can sometimes lead to authentication failures.
    5. Kerberos Ticket Retrieval:
      • Ensure that the clients you're using are set up to retrieve Kerberos tickets correctly. You may need to configure the clients via Intune, Group Policy, or a registry key as specified in the Microsoft docs.
    6. Consult the Error Logs:
      • Look at the Azure sign-in logs, which can sometimes provide additional details regarding what may be preventing successful authentication.

    Relevant Documentation:

    Please do not forget to 210246-screenshot-2021-12-10-121802.pngand “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.