Azure Files Entra Kerberos lets hybrid users skip the domain controller

When I help organisations modernise their Azure environments, one problem keeps coming back: how do Entra joined Windows devices get secure access to Azure file shares when they have no line of sight to a traditional domain controller? Azure Files Entra Kerberos finally gives Entra joined hybrid identities a way to authenticate directly to Azure Files, without the old dependencies. I've rolled this out for several customers recently. Most of them were Azure Virtual Desktop environments moving away from classic Active Directory, or companies retiring their last on-premises servers.

Entra Kerberos issues the tickets that domain controllers used to provide

With Microsoft Entra Kerberos, Entra joined clients get their Kerberos tickets from Entra ID rather than from on-premises domain controllers. So you can keep using NTFS permissions and access controls on Azure Files without a single domain controller anywhere. There is one catch, at least for now. It only works with hybrid identities, meaning users who are synced from Active Directory and have an Azure AD Kerberos key credential. Cloud-only users and guests aren't supported yet. Still, for many hybrid environments this is a big step forward.

The sequence diagram below shows how a Windows client authenticates to Azure Files using Entra Kerberos:

sequenceDiagram
    participant Client
    participant EntraID
    participant AzureFiles
    Client->>EntraID: ["Request Kerberos ticket"]
    EntraID-->>Client: ["Issue Kerberos ticket"]
    Client->>AzureFiles: ["Authenticate with Kerberos ticket"]
    AzureFiles-->>Client: ["Grant file access"]

Figure: Authentication flow with Azure Files and Entra Kerberos

If you want the full technical detail and prerequisites, read Microsoft's documentation on hybrid identities and the overview of the identity model.

Enabling Entra Kerberos starts in the storage account

In the Azure portal, go to Storage account → Data storage → File shares → Identity-based access. That's where the Microsoft Entra Kerberos toggle lives. The first time you turn it on, a global admin has to grant admin consent to the Azure Storage application in Entra ID. The portal asks for this when it's needed.

Share-level access is then controlled through RBAC. In most cases you assign the Storage File Data SMB Share Contributor or Reader role to your users or groups. NTFS permissions on their own won't do the job, because a working security model needs both RBAC and Windows ACLs. People get confused about this a lot, particularly when existing AD groups are reused in hybrid setups.

Pro tip from the trenches: Always check access after you assign RBAC roles. Hybrid group memberships can behave oddly, and in complex environments it's easy to overlook small permission mismatches.

You set Windows ACLs on the share the usual way, either through a mounted share in File Explorer or with tools like icacls. Keep in mind that you need at least read access through RBAC before you can open the share or change its permissions.

Clients must be told to fetch Kerberos tickets from the cloud

The clients also have to know that their Kerberos tickets come from Entra ID. The CloudKerberosTicketRetrievalEnabled policy handles this, and you can push it with Intune Admin Templates under System → Kerberos. If the setting is missing, authentication to Azure Files fails. I've seen this block quite a few test and pilot rollouts.

Here's a minimal Intune policy (Administrative Template) to enable it:

{
  "CloudKerberosTicketRetrievalEnabled": true
}

Deploy it via Intune → Devices → Configuration profiles → Administrative Templates → System → Kerberos.

Several limitations still trip up hybrid deployments

Azure Files Entra Kerberos makes hybrid access much simpler, but some hard limits remain. Right now only hybrid users (with synced AD objects and Kerberos keys) are supported. Cloud-only users and B2B guests can't use it yet. You also need both RBAC on the storage account and NTFS permissions on the share. If either one is missing, access fails.

One more thing to watch for. Not every synced user has the Kerberos key credential by default, so you may have to look at your user provisioning steps to make sure it's there. Microsoft describes the registration process and its caveats in the documentation.

FSLogix on Azure Virtual Desktop benefits the most

The biggest payoff comes in Azure Virtual Desktop (AVD) environments that are Entra joined and have no on-prem domain at all. FSLogix profile containers on Azure Files used to be impossible in that setup. Now, for hybrid users, they simply work. You turn on Entra Kerberos for the share, assign the correct RBAC and NTFS permissions, and FSLogix mounts user profiles with UPN-based access. This is supported from FSLogix 1.1.1045.0 onwards. I've written about configuring AVD with Entra join in more detail here: Azure Virtual Desktop Entra joined: no domain controller?.

Cloud file sharing finally works without the legacy baggage

If you want to get rid of your domain controllers but keep Windows file share access with NTFS control, Azure Files Entra Kerberos is now the option I'd pick, as long as you're working with hybrid identities. Setting it up comes down to enabling it on the storage account, getting RBAC and NTFS permissions right, and deploying the client policy for Kerberos ticket retrieval. In many of the projects I've worked on, this has made a cleaner, more cloud-native architecture possible while keeping the controls admins depend on.

Note: Parts of this article and its graphics may have been created with the help of AI.