Entra joined devices and access to local resources

Amir-G 61 Reputation points
2026-09-10T14:20:48.48+00:00

Hi everyone,

we have moved to MS365 and are now operating in a Hybrid environment, we have computers that are "Microsoft Entra hybrid joined."

I would like to gain a better understanding of how new devices that are solely joined to Entra ID (Microsoft Entra joined) can access local resources like printers and shared drives on our network storage (since they are no longer on-prem domain joined and they are in office).

I have done some research and found out about the Entra Kerberos feature.

However, we would really value your insights on this topic and any possible drawbacks of implementing it.

Windows for business | Windows 365 Business
0 comments

1 answer

Sort by: Newest
Most helpful Newest Oldest
  1. Hoang Le 4,580 Reputation points Independent Advisor
    2026-09-10T15:05:05.4233333+00:00

    Hello Amir-G,

    When you move from hybrid‑joined devices to pure Microsoft Entra joined clients, the key challenge is that they no longer have a traditional domain trust path to on‑premises Active Directory, so Kerberos tickets cannot be issued by your DCs in the usual way. The Entra Kerberos feature addresses this by allowing Entra ID to act as a cloud‑based KDC. It issues Kerberos tickets for users authenticated with Entra credentials, and those tickets are accepted by your on‑prem servers for SMB shares and print queues. In practice, this means an Entra‑joined laptop in the office can still map a drive or send a print job without being domain‑joined, provided you configure the Entra Kerberos Trusted Domain Object and deploy the proxy service.

    The main benefit is that you can support passwordless sign‑in and modern authentication while still giving access to legacy resources, which is critical in a hybrid environment. The drawbacks are that the feature is still in preview, requires at least one Windows Server 2025 domain controller, and has limitations with complex trusts and certain legacy applications. Operationally, you must maintain synchronization between Entra ID and AD DS identities, and you need to plan for the proxy deployment and monitoring. Many organizations continue to rely on hybrid join until Entra Kerberos reaches general availability, but if you want to pilot Entra‑only devices now, this is the supported path forward.

    If my answer is useful for you, please hit Accept the answer to support me.

    Thank you,

    HL.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.