Azure files not authenticating

If Microsoft Entra ID authentication for Azure Files is not working when using SSO or if the drive wont map, here are key troubleshooting steps to resolve the issue.

1. Check if Azure Files is configured for Entra ID Authentication
Azure Files supports authentication via:

• Microsoft Entra Kerberos for Hybrid Users (Recommended)
• Active Directory Domain Services (AD DS)
• Microsoft Entra Domain Services (Entra DS)

Run the following command to check if Entra ID-based authentication is enabled:

Get-AzStorageAccount -ResourceGroupName "<ResourceGroup>" -Name "<StorageAccountName>" | Select-Object -ExpandProperty AzureFilesIdentityBasedAuth

If its not enabled, set it up with:

Set-AzStorageAccount -ResourceGroupName "<ResourceGroup>" -Name "<StorageAccountName>" -AzureFilesIdentityBasedAuth ActiveDirectory

For Microsoft Entra Kerberos, enable it with:

Set-AzStorageAccount -ResourceGroupName "<ResourceGroup>" -Name "<StorageAccountName>" -EnableAzureADKerberosForFiles $true

2. Verify User Permissions on the File Share Ensure the user has both RBAC and NTFS permissions:

RBAC Permissions (Storage Account Level)

• Go to Storage Account → File Shares → Access Control (IAM).
• Assign the user Storage File Data SMB Share Contributor.

NTFS Permissions (On the File Share)

• Open Command Prompt and run:

icacls Z:\ /grant "<YourUser>@domain.com:F"

3. Ensure the client is Kerberos-enabled For Microsoft Entra Kerberos, check if your device is properly joined:

dsregcmd /status

Look for "AzureAdPrt = YES" under Device State.

If needed, force a reauthentication:

klist purge
gpupdate /force

4. Manually map the drive for debugging If SSO is failing, try manually mapping:

net use Z: \\<storageaccount>.file.core.windows.net\<sharename> /user:Azure\<StorageAccountName> <StorageAccountKey>

Or use Microsoft Entra credentials:

cmdkey /add:<storageaccount>.file.core.windows.net /user:<EntraIDUser> /pass:<Password>
net use Z: \\<storageaccount>.file.core.windows.net\<sharename>

5. Check Group Policy for Kerberos delegation (for hybrid) If using on-prem AD with Entra Kerberos, ensure Kerberos delegation is properly configured:

1. Open Group Policy Management (gpmc.msc).
2. Go to Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → Security Options.
3. Verify that "Network security: LAN Manager authentication level" is set to Send NTLMv2 response only. Refuse LM & NTLM.
4. Ensure your machine is trusted for Kerberos delegation:
   • Open Active Directory Users and Computers (dsa.msc).
   • Locate your computer object.
   • Open Delegation tab → Select "Trust this computer for delegation to specified services only" and allow CIFS.

6. Check event logs for authentication errors

• Open Event Viewer (eventvwr.msc).
• Navigate to Application and Services Logs → Microsoft → Windows → SMBClient → Connectivity.
• Look for authentication failures.

For more details, follow https://learn.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Hi Matthew Strunk,

Adding more information to the above response!

I understand the issue with authenticating Azure Files using Single Sign-On and mapping the drive. I Suggest steps to resolve this issue.

Ensure that Azure Active Directory Domain Services is correctly configured and synchronized with your Azure AD.

Make sure that the user account you are using has the necessary permissions to access the Azure file share. The user should be part of the appropriate Azure AD group that has access to the file share.

Ensure that the Group Policy settings for network drive mapping are correctly configured. You might need to update the Group Policy to allow SSO for Azure Files.

Ensure that the Azure AD PowerShell module is installed and up to date on the client machine.

Verify that you are using the correct UNC path to map the drive. The path should be in the format: \\<storage-account-name>.file.core.windows.net\<file-share-name>.

Ensure that the SMB protocol is enabled and correctly configured on the client machine. Azure Files supports SMB 3.0.

Check the event logs on the client machine for any errors related to authentication or network drive mapping.

Please let us know in the comments below, if the issue is resolved or still persists. We will be glad to assist you closely.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.