Azure Files Entra-Only Identities Ditch Active Directory for Good with Cloud-Native SMB Access

Why Entra-Only Identities Matter for Azure Files

For years, one of the biggest blockers to a fully cloud-native experience with Azure Files has been the dependency on on-premises Active Directory (AD) for SMB authentication. Organizations had to maintain hybrid sync (Entra Connect), managed domain controllers, or complex VPNs just to give users identity-based access to their file shares. This added cost, complexity, and security overhead.

Microsoft has now addressed this head-on with the general availability of Entra-Only identities for Azure Files SMB. This feature allows you to authenticate users and devices directly through Microsoft Entra ID (formerly Azure AD) without any on-premises infrastructure. No AD, no Entra Connect sync, no domain controllers. Just cloud-native identity for your file shares.

This is a game-changer for organizations looking to modernize their storage, identity, and compute stack while aligning with Zero-Trust principles. The feature is supported on both HDD and SSD shares, at no additional cost.

Source: Azure Blog - Azure Files Entra-Only Identities

How It Works: Kerberos Without AD

The magic behind Entra-Only identities is that Microsoft Entra ID now acts as the primary Kerberos Key Distribution Center (KDC). When a client (Windows, macOS, or Linux) wants to access an Azure File share, it follows this flow:

1. Client requests a Kerberos ticket from Entra ID for the Azure Files service.
2. Entra ID issues a ticket containing cloud-based security identifiers (SIDs) for the user or device.
3. The ticket is presented during the SMB session setup.
4. Azure Files validates the ticket and establishes the session.
5. Authorization uses standard NTFS ACLs, now extended to Entra-Only users and groups.

The SMB protocol itself remains unchanged, so all your existing applications and workflows continue to work. The only difference is that identity validation and ticket issuance are now handled entirely by Entra ID.

Key Components

• Portal-based NTFS permissions management: You can now configure granular file and directory ACLs for Entra-Only users and groups directly from the Azure portal. No domain-joined client needed.
• Expanded RBAC support: Share-level RBAC for specific users and groups is now available for Entra-Only identities in limited regions (check regional availability).
• MacOS support (limited preview): Secure file share access for Entra-joined MacOS clients via Platform SSO.
• Managed Identities (GA): Applications and services can use Managed Identities with OAuth tokens for SMB access, eliminating shared keys or secrets.

Example: Configuring a Share with Entra-Only Access (Azure CLI)

# Create a storage account (if not already existing)
az storage account create \
    --name mystorageaccount \
    --resource-group myResourceGroup \
    --location eastus \
    --sku Standard_LRS \
    --kind StorageV2

# Enable Entra-Only authentication for the storage account
az storage account update \
    --name mystorageaccount \
    --resource-group myResourceGroup \
    --enable-files-aadkerb true

# Create a file share
az storage share create \
    --account-name mystorageaccount \
    --name myfileshare \
    --quota 100

# Assign share-level RBAC role to an Entra-Only user (Storage File Data SMB Share Contributor)
az role assignment create \
    --assignee "user@contoso.com" \
    --role "Storage File Data SMB Share Contributor" \
    --scope "/subscriptions/<subscription-id>/resourceGroups/myResourceGroup/providers/Microsoft.Storage/storageAccounts/mystorageaccount/fileServices/default/shares/myfileshare"

Note: Portal-based NTFS ACL editing is available directly from the Azure portal under the file share's "Properties" > "Access Control (IAM)" > "NTFS Permissions".

Hero Workloads: VDI, File Sharing, and Remote Work

VDI with FSLogix and Azure Virtual Desktop

One of the most compelling use cases is VDI profile management using FSLogix profile containers stored on Azure Files Premium. With Entra-Only identities, you can deploy a fully cloud-native stack:

• Identity: Microsoft Entra ID (no AD)
• Compute: Azure Virtual Desktop (AVD) session hosts (Entra-joined)
• Storage: Azure Files Premium with SMB access via Kerberos

This eliminates the need for hybrid identity infrastructure, domain controllers, or line-of-sight to on-premises systems. Users sign in with their cloud-native identities and get their FSLogix profiles seamlessly.

B2B support extends this further: external partners can use their existing identities to access AVD desktops and load FSLogix profiles without creating duplicate accounts.

"With Entra-Only identity access with Azure Files, WTW has been able to deliver insurance applications to customers on AVD using their existing Entra identities. FSLogix profile containers stored on Azure File Shares ensure users receive a consistent profile experience across any AVD host they connect to." — Gordon Griffin, Technical Director, Willis Tower Watson

General-Purpose File Sharing

For information workers and distributed teams, Entra-Only identities simplify access to shared folders:

• New users get access through Entra groups.
• Permissions are enforced consistently across locations.
• No VPN, no domain-joined device required.
• Faster onboarding and reduced helpdesk overhead.

Remote and Field Workforces

Oil and gas, engineering, and other industries with remote workers can now securely access critical datasets from field locations without complex multi-domain AD configurations or VPNs. Engineers authenticate directly with Entra ID and access Azure Files, improving reliability in low-connectivity environments.

Limitations and Caveats

While Entra-Only identities are a major step forward, there are some important considerations:

• Legacy application compatibility: Some older applications that depend on on-premises AD for authentication (e.g., NTLM, legacy Kerberos) may not work with Entra-Only identities. Test thoroughly before migration.
• MacOS support is in limited preview: Not all MacOS clients are supported yet. Check documentation for eligibility.
• RBAC for specific users/groups is limited regionally: Check Azure region availability before planning.
• No support for sovereign clouds yet: Government and regulated environments will need to wait for future updates.
• NTFS ACL portal editing is basic: While functional, the portal experience is not as rich as native Windows ACL editors. Advanced permissions management may still require a client tool.

Next Steps and Learning Path

1. Explore the documentation: Enable Microsoft Entra Kerberos authentication for hybrid and cloud-only identities (preview) on Azure Files
2. Test with a non-production storage account: Start with a small share and a few Entra-Only users.
3. Migrate a pilot VDI workload: Use AVD with FSLogix and Entra-Only identities to validate the experience.
4. Plan for MacOS preview: If you have MacOS users, register for the limited preview.
5. Monitor for sovereign cloud support: If you operate in regulated environments, watch for announcements.

Related Resources

• Meta Ranking Engineer Agent: The Autonomous AI Agent That's 5x More Productive at ML Experimentation
• Deploy LLMs in Minutes with SageMaker HyperPod Inference Operator as an EKS Add-On