Entra joined devices and access to local resources

Question

Entra joined devices and access to local resources

Amir-G 61

Hi everyone,

we have moved to MS365 and are now operating in a Hybrid environment, we have computers that are "Microsoft Entra hybrid joined."

I would like to gain a better understanding of how new devices that are solely joined to Entra ID (Microsoft Entra joined) can access local resources like printers and shared drives on our network storage (since they are no longer on-prem domain joined and they are in office).

I have done some research and found out about the Entra Kerberos feature.

However, we would really value your insights on this topic and any possible drawbacks of implementing it.

0 comments

1 answer

Your answer

Answer 1

Hi Amir,

Thank you for posting your question in the Microsoft Q&A forum.

Yes, your new Entra joined PCs can access local file shares and printers without joining the AD domain. For single sign-on (SSO) to resources that use AD authentication, users need AD accounts synchronized to Entra ID. The PCs also need network access to your domain controllers and the resources. Please visit this document for more details: How SSO to on-premises resources works on Microsoft Entra joined devices - Microsoft Entra ID | Mic…

If you're planning to use Windows Hello for Business with a PIN or biometrics, cloud Kerberos trust is a supported option. Your identity administrator would create the Entra Kerberos server object for the relevant AD domain, then enable Windows Hello for Business and its cloud-trust policy on the PCs. The deployment guide covers the requirements and setup.

For your planned rollout, these limitations are worth checking:

Local AD and domain-controller connectivity are still needed. The PC exchanges Entra ID’s partial Kerberos ticket with a domain controller for a full AD ticket; existing resource permissions still apply. See the authentication flow.
Entra joined PCs have no local AD computer account, so resources requiring AD machine authentication won't work. Domain Group Policies also won't apply, so existing drive-mapping and printer-deployment policies need another delivery method, such as your device-management solution Plan your Microsoft Entra join deployment - Microsoft Entra ID | Microsoft Learn
Cloud Kerberos trust blocks certain privileged AD accounts by default. Use an regular user account for a test, don't relax that protection to make an administrator account work.

Before choosing the configuration, confirm whether your storage uses AD authentication or separate local accounts, whether the printers are shared through a Windows print server, and how users will sign in to Windows. That will help you choose the setup that fits your environment.